d72155b95d4a53a3399044273b68ac273b708ab360b8bbeb2a44a9bcc6a3bd05

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24147881c3d393d0a8c7c8c62668e88c.exe
Size

14KB
MD5

24147881c3d393d0a8c7c8c62668e88c
SHA1

bc724981cab03f87518b566afb786a596361f276
SHA256

d72155b95d4a53a3399044273b68ac273b708ab360b8bbeb2a44a9bcc6a3bd05
SHA512

9ab5c435f275b1ae2f6fcc6d68ab8eefe1f8cb0456c75a05f9d30b1a2a81f1fd20e92fb7ea5c97f883961ed41d6781f5ae45a29a4575760f5dd301c50eadc021
SSDEEP

384:UcQIjE5EpcvLfhc5waHf3zNZGtIUE7q1mozuOsf3:UsrpcDiqavR0Cq1ZVsP

Score

8^/10

persistence upx

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Deletes itself 1 IoCs

pid	Process
2708	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2996	micsusk.exe

Loads dropped DLL 2 IoCs

pid	Process
624	24147881c3d393d0a8c7c8c62668e88c.exe
624	24147881c3d393d0a8c7c8c62668e88c.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/624-0-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/files/0x000b000000015c3d-3.dat	upx
behavioral1/memory/624-4-0x0000000000230000-0x000000000023F000-memory.dmp	upx
behavioral1/memory/624-11-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/2996-12-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\micsus.dll	24147881c3d393d0a8c7c8c62668e88c.exe
File created	C:\Windows\SysWOW64\micsusk.exe	24147881c3d393d0a8c7c8c62668e88c.exe
File opened for modification	C:\Windows\SysWOW64\micsusk.exe	24147881c3d393d0a8c7c8c62668e88c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2996	624	24147881c3d393d0a8c7c8c62668e88c.exe	28
PID 624 wrote to memory of 2996	624	24147881c3d393d0a8c7c8c62668e88c.exe	28
PID 624 wrote to memory of 2996	624	24147881c3d393d0a8c7c8c62668e88c.exe	28
PID 624 wrote to memory of 2996	624	24147881c3d393d0a8c7c8c62668e88c.exe	28
PID 624 wrote to memory of 2708	624	24147881c3d393d0a8c7c8c62668e88c.exe	29
PID 624 wrote to memory of 2708	624	24147881c3d393d0a8c7c8c62668e88c.exe	29
PID 624 wrote to memory of 2708	624	24147881c3d393d0a8c7c8c62668e88c.exe	29
PID 624 wrote to memory of 2708	624	24147881c3d393d0a8c7c8c62668e88c.exe	29

C:\Users\Admin\AppData\Local\Temp\24147881c3d393d0a8c7c8c62668e88c.exe
"C:\Users\Admin\AppData\Local\Temp\24147881c3d393d0a8c7c8c62668e88c.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\micsusk.exe
  C:\Windows\system32\micsusk.exe ˜‰
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\24147881c3d393d0a8c7c8c62668e88c.exe.bat
  2⤵
  - Deletes itself
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\24147881c3d393d0a8c7c8c62668e88c.exe.bat

Filesize
182B

MD5
2944d852d1d51ac99fd5d00a4bc49c70

SHA1
9ad8d5c2fd88e8ca1a0f74dc3db927d409e9b06d

SHA256
4f58f16d891324a4070562882932987b7bd3ff9a7ddf7494e930f1cbfb72ea5e

SHA512
e9ca295abe7e85a371e61d374fd2fc2ec9a1d7e042ecc4406f97a42372d4463aff73a50deb7506db2310ee44cab25a7aa404b1ebd27922c5d3d6ca1aabbf7b60

Download Submit
\Windows\SysWOW64\micsusk.exe

Filesize
14KB

MD5
24147881c3d393d0a8c7c8c62668e88c

SHA1
bc724981cab03f87518b566afb786a596361f276

SHA256
d72155b95d4a53a3399044273b68ac273b708ab360b8bbeb2a44a9bcc6a3bd05

SHA512
9ab5c435f275b1ae2f6fcc6d68ab8eefe1f8cb0456c75a05f9d30b1a2a81f1fd20e92fb7ea5c97f883961ed41d6781f5ae45a29a4575760f5dd301c50eadc021

Download Submit
memory/624-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/624-4-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/624-11-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/624-15-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2996-12-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download