84bd28ad0a0c5769be0ce8a63460f6fc25d7ffaff5a443a0ca734ea5f2446319

Analysis

max time kernel
123s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 05:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a480ca7c6905a9a71bec14d44dcd09f.exe
Size

195KB
MD5

2a480ca7c6905a9a71bec14d44dcd09f
SHA1

371e0aa38ba520120ea8be4fed6626dd69f81466
SHA256

84bd28ad0a0c5769be0ce8a63460f6fc25d7ffaff5a443a0ca734ea5f2446319
SHA512

35adb5a97e1ffaf17eb0ed4997db512ed7f5555e40e991d87ddb2364cf0113611a85fb586ca1247ea6da0f38547e1bf992a612778f3af4c97fde98003305fa5a
SSDEEP

3072:cxO2r/iUaXeXyGtHo8PFU9bDf1lAnfuEvaQGWVdYp5mG7H8eVt1cOmSDRGSItL:cz7iUatGJoSYf1lcuEDtdYp5mMVISW

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2812	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
336	csrss.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1308-0-0x0000000000400000-0x000000000043F000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1308 set thread context of 2812	1308	2a480ca7c6905a9a71bec14d44dcd09f.exe	28

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{be82c772-285b-b66e-f167-51111c07bcd8}	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{be82c772-285b-b66e-f167-51111c07bcd8}\u = "37"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{be82c772-285b-b66e-f167-51111c07bcd8}\cid = "8937383231607598586"	explorer.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	explorer.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2812	1308	2a480ca7c6905a9a71bec14d44dcd09f.exe	28
PID 1308 wrote to memory of 2812	1308	2a480ca7c6905a9a71bec14d44dcd09f.exe	28
PID 1308 wrote to memory of 2812	1308	2a480ca7c6905a9a71bec14d44dcd09f.exe	28
PID 1308 wrote to memory of 2812	1308	2a480ca7c6905a9a71bec14d44dcd09f.exe	28
PID 1308 wrote to memory of 2812	1308	2a480ca7c6905a9a71bec14d44dcd09f.exe	28
PID 2812 wrote to memory of 336	2812	explorer.exe	4
PID 336 wrote to memory of 2804	336	csrss.exe	29
PID 336 wrote to memory of 2804	336	csrss.exe	29
PID 336 wrote to memory of 2420	336	csrss.exe	30
PID 336 wrote to memory of 2420	336	csrss.exe	30

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Users\Admin\AppData\Local\Temp\2a480ca7c6905a9a71bec14d44dcd09f.exe
"C:\Users\Admin\AppData\Local\Temp\2a480ca7c6905a9a71bec14d44dcd09f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\explorer.exe
  00000060*
  2⤵
  - Deletes itself
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2812

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2804

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.DLL

Filesize
31KB

MD5
dafc4a53954b76c5db1d857e955f3805

SHA1
a18fa0d38c6656b4398953e77e87eec3b0209ef3

SHA256
c6c82dde145a2dd9d70b1b539b17571befb663fc4a9ca834ff2a140cc4ebaa0b

SHA512
745e27a4f952e2492dbd12ced396be2c7dc78344ba415ad64b45920f95d7a282e30c7ad2da9266dc195c71e38019809e8183a705f9276c7d178de2f5ef34b633

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
1f261304ad59cae4dc0615d072efc391

SHA1
acd18bebf8b248af05602b2ecaec497c2c98a027

SHA256
00ea19c2ad54402455553739d51b93c01508b0dd459c8a0eb3578606c976d173

SHA512
fc758f34d32c4e7b8a749cb1ca54c5c6a24c23b2b6e3ccce777e404a2cfc8a8250255e8c89742394cbb8a15a052a34314da011ba5dc29fffd2ccf5bb65066b74

Download Submit
memory/336-19-0x0000000000920000-0x000000000092C000-memory.dmp

Filesize
48KB

Download
memory/336-20-0x0000000000920000-0x000000000092C000-memory.dmp

Filesize
48KB

Download
memory/1308-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1308-1-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/1308-2-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2812-3-0x00000000001F0000-0x0000000000204000-memory.dmp

Filesize
80KB

Download
memory/2812-6-0x0000000000060000-0x0000000000072000-memory.dmp

Filesize
72KB

Download
memory/2812-9-0x00000000001F0000-0x0000000000204000-memory.dmp

Filesize
80KB

Download
memory/2812-14-0x00000000001F0000-0x0000000000204000-memory.dmp

Filesize
80KB

Download