efbb014d82aef853b10a2b8de542c04981cec30ae705f62a5b6b2202b08aa2ce

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ba2d64ff7d998f96db7657b9ebd307b.exe
Size

423KB
MD5

1ba2d64ff7d998f96db7657b9ebd307b
SHA1

d2d048a2320930c520f52f870bc9c210f30ff38c
SHA256

efbb014d82aef853b10a2b8de542c04981cec30ae705f62a5b6b2202b08aa2ce
SHA512

e53579b4ea6a668d86ee064b608b056ec2c81580ecd524796d6f3d6ba77205c0c3174624e4ec91eca469f80b8301efe488b165cea4d07b351ac0e501da22fb66
SSDEEP

6144:oxJ61E0Fg0C7pzNZT3KUDEeuH4RU0yDaytuxcz7TPUhKuh9EOSTsoSS6v:oxgvC79NZTaGuwiuxu7Tkf9E9TsoSr

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4648-0-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/4648-14-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral2/memory/4648-16-0x0000000000400000-0x0000000000541000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4648	1ba2d64ff7d998f96db7657b9ebd307b.exe
4648	1ba2d64ff7d998f96db7657b9ebd307b.exe
4648	1ba2d64ff7d998f96db7657b9ebd307b.exe
4648	1ba2d64ff7d998f96db7657b9ebd307b.exe

C:\Users\Admin\AppData\Local\Temp\1ba2d64ff7d998f96db7657b9ebd307b.exe
"C:\Users\Admin\AppData\Local\Temp\1ba2d64ff7d998f96db7657b9ebd307b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\GetRightToGo\1ba2d64ff7d998f96db7657b9ebd307b.data

Filesize
582B

MD5
1999ed7fc05ac1e7644b6fb7f067542d

SHA1
2f8f001dabc376e06190ab8316ad1663bd30038a

SHA256
063751312d5e1991e7925dfa575497de5ab6fbd9b73d16bcc7b5a2fa833fb792

SHA512
df63328ebd2b7c29b3a0febaff706d0046303ba20001e52d5a1ab71e6fe8eeb42f1802d939a14ae9865d84b7d9f57b894deb34c3418127383b028c77dcecf35f

Download Submit
memory/4648-0-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/4648-14-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/4648-16-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download