98975f44f884d17889309e0a91f0ac48fbb098184a32685deac773345cfdb88d

Analysis

max time kernel
151s
max time network
162s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98975f44f884d17889309e0a91f0ac48fbb098184a32685deac773345cfdb88d.exe
Size

536KB
MD5

b417683b010f08fd682e1ecd08df390f
SHA1

acb0cbea21503f9a5496a54a4e37a426dd86dd1d
SHA256

98975f44f884d17889309e0a91f0ac48fbb098184a32685deac773345cfdb88d
SHA512

335d874a3079121aa1a21eaa896eee103c341cbdac3a0fee559c6ef54ea19787b087168f2931aa91a6ecb697c4fca0382489288652bff9471e2e34b77ae8b146
SSDEEP

12288:Fhf0Bs9bDDq9hu53Ltp/p+gPhhwPOaoTJRkmOkx2LIa:FdQyDL9xp/BGA1RkmOkx2LF

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2356-0-0x0000000000890000-0x0000000000992000-memory.dmp	upx
behavioral1/memory/2356-42-0x0000000000890000-0x0000000000992000-memory.dmp	upx
behavioral1/memory/2356-155-0x0000000000890000-0x0000000000992000-memory.dmp	upx
behavioral1/memory/2356-256-0x0000000000890000-0x0000000000992000-memory.dmp	upx
behavioral1/memory/2356-627-0x0000000000890000-0x0000000000992000-memory.dmp	upx

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	114.114.114.114
Destination IP	114.114.114.114

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\2855e8	98975f44f884d17889309e0a91f0ac48fbb098184a32685deac773345cfdb88d.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2356	98975f44f884d17889309e0a91f0ac48fbb098184a32685deac773345cfdb88d.exe
2356	98975f44f884d17889309e0a91f0ac48fbb098184a32685deac773345cfdb88d.exe
2356	98975f44f884d17889309e0a91f0ac48fbb098184a32685deac773345cfdb88d.exe
2356	98975f44f884d17889309e0a91f0ac48fbb098184a32685deac773345cfdb88d.exe
2356	98975f44f884d17889309e0a91f0ac48fbb098184a32685deac773345cfdb88d.exe
1256	Explorer.EXE
1256	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	98975f44f884d17889309e0a91f0ac48fbb098184a32685deac773345cfdb88d.exe
Token: SeTcbPrivilege	2356	98975f44f884d17889309e0a91f0ac48fbb098184a32685deac773345cfdb88d.exe
Token: SeDebugPrivilege	2356	98975f44f884d17889309e0a91f0ac48fbb098184a32685deac773345cfdb88d.exe
Token: SeDebugPrivilege	1256	Explorer.EXE
Token: SeTcbPrivilege	1256	Explorer.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1256	2356	98975f44f884d17889309e0a91f0ac48fbb098184a32685deac773345cfdb88d.exe	13
PID 2356 wrote to memory of 1256	2356	98975f44f884d17889309e0a91f0ac48fbb098184a32685deac773345cfdb88d.exe	13
PID 2356 wrote to memory of 1256	2356	98975f44f884d17889309e0a91f0ac48fbb098184a32685deac773345cfdb88d.exe	13

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256
- C:\Users\Admin\AppData\Local\Temp\98975f44f884d17889309e0a91f0ac48fbb098184a32685deac773345cfdb88d.exe
  "C:\Users\Admin\AppData\Local\Temp\98975f44f884d17889309e0a91f0ac48fbb098184a32685deac773345cfdb88d.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
097219044854d4ac98eb8c272b6de15c

SHA1
d3e2d0cc2dcf1309a321ded7231031ec8ae33f19

SHA256
ee411b9b73f132a4b6ac6f5879e94ea284402fad35661e6de1bab8f50305b27a

SHA512
3a2b4e6eb8b076e91e32569a420a51b2dd552ac09f44e074133801b8c7fbf092203183c30ab100af95e2437428278fee592dbef34f19d923d9357c6744bdc3d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff3fbcb189a1d7ae86fe2ad7c7504436

SHA1
798a1a2654b0fb4cbfcaeb9bb9c9e4070e604a83

SHA256
8dcc029bfaaa9d97a4e84863f77d8605c6eaaee4ee3a6da61fc0fcee565519cd

SHA512
ff7a324c619cbb5de8234244119d3ad32d43600fd31b7faec23eb0fc82d05f8d9807dfe26e06d8f81e2a8bf8dba76d4de2cf2480fea3da9a7b6b9304038bb8b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75ae5f1238d98d55f2b1e635541292ff

SHA1
cc89a344814956e3c6c5b32fea2c5e77366543d6

SHA256
ea22f5c8e13522128e66facfa973470ff5b9fb1b7ada48eef3794952ded380db

SHA512
8291ae984c15773652dfe61869ebe0f4d249ee01d8c9ba9dd6396208c10c7a8c52b949da5e9ff30b4b4121beaed08c73cfc72bce8e887a391fe89c3018d44466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91347a5ebba33ce2061a38a9c460bd26

SHA1
2cb239578e870c2ae6f9529dfac6aae7659a64a3

SHA256
3704bddd8a611b7547188b6d42ebcc94f2b5fce30722291bc9b635cf8936b64d

SHA512
f91f775c7c98a6ebb7b652a698aef782d3957a6c5fab164e852a2e1c9049e47ab32862df4e5abc0ea1f5fddcd89619a1079e2fb1126018bacd59ec895dbe683d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1b8134f1c879829511be6ab430e7768

SHA1
019d4ef3a5771c8f6341614e33a75149c23881cd

SHA256
b8a76c5da6aed91edce1ba1759b814ad1246a80d7a6a5ec9fbfc659d41fb493b

SHA512
9853a1e1d271022e8f66963660097dea59aed415a227d459a4372b70586256a599d345d706d1bed1a6fc2d21aada4cea831fe84869fb6f4cca20fb20e9602816

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b215a507883f28182abdb02e47b49d9

SHA1
760cd7b462836b49f2b39bb1751f6a07f2f6aea4

SHA256
7defd20183d20623ad8bfa70ae6b14e3b72547090d0af39eae6154f3d3fdc6c9

SHA512
cbc421cb5d42c766e129e5165a67f28853a4634d9b681f7b165b1612388538f5382bad39926bfc1cb6fcbc6c70e40fdf1ddd23f0211c0273ca095701ebd1b84a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e112de827b9602d68a00b897ee5487d2

SHA1
5181e55a7a818101ef4f077fa3189a6cb8a8130d

SHA256
e8baa3876741dbb3bb99a3ba5ecc25558b99513fdffcb2cf0b34bac9a50080a2

SHA512
d4b538b0752d28ec76dfdebc3990811679f260926603d1e608227260e78c43c6643c73cc94431adcb9c571c58bd0255eb0dfc3d5967f3322792921140640236a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAC58.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAC7A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1256-116-0x0000000002B00000-0x0000000002B79000-memory.dmp

Filesize
484KB

Download
memory/1256-6-0x0000000002B00000-0x0000000002B79000-memory.dmp

Filesize
484KB

Download
memory/1256-4-0x0000000002A10000-0x0000000002A13000-memory.dmp

Filesize
12KB

Download
memory/1256-3-0x0000000002A10000-0x0000000002A13000-memory.dmp

Filesize
12KB

Download
memory/2356-155-0x0000000000890000-0x0000000000992000-memory.dmp

Filesize
1.0MB

Download
memory/2356-256-0x0000000000890000-0x0000000000992000-memory.dmp

Filesize
1.0MB

Download
memory/2356-42-0x0000000000890000-0x0000000000992000-memory.dmp

Filesize
1.0MB

Download
memory/2356-0-0x0000000000890000-0x0000000000992000-memory.dmp

Filesize
1.0MB

Download
memory/2356-627-0x0000000000890000-0x0000000000992000-memory.dmp

Filesize
1.0MB

Download