dd1e6f1793d1238fa162509cdb2a593b0564f9c599c06e72393d879daaeb8c21

Analysis

max time kernel
150s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5a297fc2b9f8fbec338ca792bb74cbca.exe
Size 11KB
Sample240114-d3936acdb4
SHA256 dd1e6f1793d1238fa162509cdb2a593b0564f9c599c06e72393d879daaeb8c21
MD5 5a297fc2b9f8fbec338ca792bb74cbca
SHA1 882b58dcfc3251d36abd4e4a59bdbfae6d185804
SHA512 60bf558726311cea682b7762895eedbb8a90b3a5c0dbdc47976ee5136154fd7583156fcc67f6ae1af49540dc99ec7db9745d43fcbb5daf43a259f28e3c6de63b
SSDEEP 192:XgU9coGIDiMOpctVYl3Y2Mq6D2D7WBLj0Vcot1638FWwFuFLblqtEMKVrZXTg:XgDIDsctVQo2n6D2DaGbWwFuJxqtbK4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4772-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4772-1-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\5a297fc2b9f8fbec338ca792bb74cbca.exe
"C:\Users\Admin\AppData\Local\Temp\5a297fc2b9f8fbec338ca792bb74cbca.exe"
1⤵
PID:4772

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -lc NDIS NDIS-20240114-0334.dmp
1⤵
PID:4076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4772-0-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4772-1-0x0000000000400000-0x000000000041E000-memory.dmp