71fdf0b969bb4532dd471fbd832913bba8d1be3ac16f178393bb111b4fdc152a

Analysis

max time kernel
0s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:34

Target

2859ff00b4d0ecbc0075a725d0217e7d.exe
Size

70KB
MD5

2859ff00b4d0ecbc0075a725d0217e7d
SHA1

b5e9ae069aafd2645dd8bc0e631397f13fb89f7d
SHA256

71fdf0b969bb4532dd471fbd832913bba8d1be3ac16f178393bb111b4fdc152a
SHA512

3b4715f406fe684c30d0f00d0f52bf5e25cc4727598b37a63cccc21acc68e5bf02e8938b25ec67b794651f4fc97fd3e9fa011175ddf519389057c96127684ebc
SSDEEP

1536:Qc+E19oIzg3CJuL0gZEQ5w7x3kWM0erCdqeFPF4oEF6mQ81:RzjoIzg3Ci6uW3l8rCf781

Score

8^/10

evasion upx

Executes dropped EXE 1 IoCs

pid	Process
2204	msnmsgr.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2368-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/2204-17-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/2204-14-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/files/0x000c000000014b31-11.dat	upx
behavioral1/memory/2368-23-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\msnmsgr.exe	2859ff00b4d0ecbc0075a725d0217e7d.exe
File opened for modification	C:\Windows\msnmsgr.exe	2859ff00b4d0ecbc0075a725d0217e7d.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2992	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2368	2859ff00b4d0ecbc0075a725d0217e7d.exe
2204	msnmsgr.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	2368	2859ff00b4d0ecbc0075a725d0217e7d.exe
Token: SeSystemtimePrivilege	2368	2859ff00b4d0ecbc0075a725d0217e7d.exe
Token: SeSystemtimePrivilege	2368	2859ff00b4d0ecbc0075a725d0217e7d.exe
Token: SeSystemtimePrivilege	2368	2859ff00b4d0ecbc0075a725d0217e7d.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2992	2368	2859ff00b4d0ecbc0075a725d0217e7d.exe	17
PID 2368 wrote to memory of 2992	2368	2859ff00b4d0ecbc0075a725d0217e7d.exe	17
PID 2368 wrote to memory of 2992	2368	2859ff00b4d0ecbc0075a725d0217e7d.exe	17
PID 2368 wrote to memory of 2992	2368	2859ff00b4d0ecbc0075a725d0217e7d.exe	17
PID 2368 wrote to memory of 2204	2368	2859ff00b4d0ecbc0075a725d0217e7d.exe	18
PID 2368 wrote to memory of 2204	2368	2859ff00b4d0ecbc0075a725d0217e7d.exe	18
PID 2368 wrote to memory of 2204	2368	2859ff00b4d0ecbc0075a725d0217e7d.exe	18
PID 2368 wrote to memory of 2204	2368	2859ff00b4d0ecbc0075a725d0217e7d.exe	18

C:\Users\Admin\AppData\Local\Temp\2859ff00b4d0ecbc0075a725d0217e7d.exe
"C:\Users\Admin\AppData\Local\Temp\2859ff00b4d0ecbc0075a725d0217e7d.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\50reg.reg
  2⤵
  - Runs .reg file with regedit
  PID:2992
- C:\Windows\msnmsgr.exe
  C:\Windows\msnmsgr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2204

C:\50reg.reg

Filesize
121B

MD5
8c0c2a3561f09e9da4f663ebd9db06dc

SHA1
060cfdaa3aa592ec1bede0c4e71a6da3baf42dd4

SHA256
4c3f8b2bae6bd3dec43219df3845068964d4a2e398bc20a32e75d7379d0a1c03

SHA512
b45639591a3ad789831d6b45dd5e7e5cee5e8206f3fa225e39032e1f64d4dd3e74cd367444d615fa89259176e28cfeaa03106c87e12c45d4d5e4c9975b4a8ec8

Download Submit
C:\Windows\msnmsgr.exe

Filesize
70KB

MD5
2859ff00b4d0ecbc0075a725d0217e7d

SHA1
b5e9ae069aafd2645dd8bc0e631397f13fb89f7d

SHA256
71fdf0b969bb4532dd471fbd832913bba8d1be3ac16f178393bb111b4fdc152a

SHA512
3b4715f406fe684c30d0f00d0f52bf5e25cc4727598b37a63cccc21acc68e5bf02e8938b25ec67b794651f4fc97fd3e9fa011175ddf519389057c96127684ebc

Download Submit
memory/2204-17-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2204-14-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2368-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2368-13-0x0000000003100000-0x0000000003122000-memory.dmp

Filesize
136KB

Download
memory/2368-12-0x0000000003100000-0x0000000003122000-memory.dmp

Filesize
136KB

Download
memory/2368-18-0x0000000003ED0000-0x0000000004F32000-memory.dmp

Filesize
16.4MB

Download
memory/2368-23-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2368-25-0x0000000003100000-0x0000000003122000-memory.dmp

Filesize
136KB

Download