Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    27-01-2024 15:43

General

  • Target

    7aa2f47d3b960b717993b338705f442b.exe

  • Size

    63KB

  • MD5

    7aa2f47d3b960b717993b338705f442b

  • SHA1

    12a7ab999312e41b83f67b6496376da18269df94

  • SHA256

    157ed1654d7b6a6166a05e634c0df2785599086fda6e773ea7a723cfb3496668

  • SHA512

    52f833b53a1e9d0e3079cc4bc484cbf3a2a0a9aa54b38150218d44434f0f7d91d67d8319486d607e8fc30688ebefb54b1498e95dab7b82e3bc95b6501be067b9

  • SSDEEP

    768:oZ0xsb8grTI3XZY5hDOOpxMx6THDK1NpyVOYrkBvUQGOF8gfXMub0narzIfGZ+Di:oSxsYgwoDO1+2VmaXpNZ+23

Score
7/10

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7aa2f47d3b960b717993b338705f442b.exe
    "C:\Users\Admin\AppData\Local\Temp\7aa2f47d3b960b717993b338705f442b.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3060-0-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/3060-4-0x0000000000020000-0x000000000002C000-memory.dmp

    Filesize

    48KB

  • memory/3060-3-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/3060-2-0x0000000000020000-0x000000000002C000-memory.dmp

    Filesize

    48KB

  • memory/3060-5-0x0000000000020000-0x000000000002C000-memory.dmp

    Filesize

    48KB