dba10a8392d751218b8d2c49ef970069acd154de199d7e564b7f25cf97233999

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b7b79e1a3bd6676d56bfd4328ad825d.exe
Size

374KB
MD5

3b7b79e1a3bd6676d56bfd4328ad825d
SHA1

06ff9b8b19e36985f564ff5b5fba48f5842bf138
SHA256

dba10a8392d751218b8d2c49ef970069acd154de199d7e564b7f25cf97233999
SHA512

4820e31aaf01279976abda6b64e4ec1ad4173d4dc1419f14b6e4cd7d4cc67c0b3c56060067d63590026bef123f626627d84c6ead8608b3f7566722607736b324
SSDEEP

6144:PLIAsKyQZzE4BDXcSfVGZYjnS0PvI4F50ugjgAJKk/mA5OKA4ddthwmmkzsNx3Ci:PLIobEWXcSN3jhl/0uIgMl/mAcKZh/ZQ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1716-0-0x0000000000400000-0x0000000000500000-memory.dmp	upx
behavioral2/memory/1716-9-0x0000000000400000-0x0000000000500000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1716	3b7b79e1a3bd6676d56bfd4328ad825d.exe
1716	3b7b79e1a3bd6676d56bfd4328ad825d.exe

C:\Users\Admin\AppData\Local\Temp\3b7b79e1a3bd6676d56bfd4328ad825d.exe
"C:\Users\Admin\AppData\Local\Temp\3b7b79e1a3bd6676d56bfd4328ad825d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\GetRightToGo\3b7b79e1a3bd6676d56bfd4328ad825d.data

Filesize
766B

MD5
6ad04056b3ef59f30da4d31c933033d4

SHA1
7c764231bf78af1abb34eefc87f36e9a6fda7b1f

SHA256
fadc1fe98094778c7f9b141c71992d217382337743d90cf23fd23062f60e7f04

SHA512
9c5e67474a4a4609b8b591d0a63f8b743da4eaa14533aa6fd4da399551b225ab6792c99424b584e8b6b44277d6f5fbfc230ec5e50fa31da6becc1590a1ced363

Download Submit
memory/1716-0-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/1716-9-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download