1de07d84a45a879da23c6a6248485522d03e339d0d384ec1e8edf5fd0384f40b | Triage

Analysis

max time kernel
2s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2024 08:44

Sharing

Report Analysis Logs

General

Target

501c50307b00b8b2d9a7a112eb71d421.exe
Size

20KB
MD5

501c50307b00b8b2d9a7a112eb71d421
SHA1

03e912f2157056569622668cba143e2e679f1d18
SHA256

1de07d84a45a879da23c6a6248485522d03e339d0d384ec1e8edf5fd0384f40b
SHA512

28053e6c1ea55ed4eadea04b84ad9517a2da11e7bc3290925261350daf342132b95aa95ae3ed16a499571680f384830df0244673217ecbe617ffb444df065582
SSDEEP

384:ZM0U/LqWdSagnps4GOirBhPaN6BFho1b5ru:CR+CSaflG0C

Score

8^/10

evasion upx

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1456-0-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/1456-3-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Modifies registry class 7 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\OpenWithList\AcroRd32.exe	501c50307b00b8b2d9a7a112eb71d421.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\OpenWithList	501c50307b00b8b2d9a7a112eb71d421.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\.pdf\OpenWithProgids	501c50307b00b8b2d9a7a112eb71d421.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\PersistentHandler	501c50307b00b8b2d9a7a112eb71d421.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	501c50307b00b8b2d9a7a112eb71d421.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ShellEx	501c50307b00b8b2d9a7a112eb71d421.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\.pdf	501c50307b00b8b2d9a7a112eb71d421.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1456	501c50307b00b8b2d9a7a112eb71d421.exe

C:\Users\Admin\AppData\Local\Temp\501c50307b00b8b2d9a7a112eb71d421.exe
"C:\Users\Admin\AppData\Local\Temp\501c50307b00b8b2d9a7a112eb71d421.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1456-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1456-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download