60a47118689256ba4bcfb6cc21ba69f17c7ca11fcefeb657525a9671f6edcfb9

Analysis

max time kernel
140s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d70b51d015b65a316dd7cd7da52bb1c.exe
Size

29KB
MD5

7d70b51d015b65a316dd7cd7da52bb1c
SHA1

269f3c977277245137d9e72f2553a6415cf03a44
SHA256

60a47118689256ba4bcfb6cc21ba69f17c7ca11fcefeb657525a9671f6edcfb9
SHA512

12e37c811e3bca94995e187dd8ec8d85b15ba5b7746e2d63e871148c32ba750b33b89d62f24dbc1c858e716de3d48fc97a6a6fbb450e711b90ef0c4581d60d8b
SSDEEP

768:GC+BVCW//ex21AQYRIfeN9R9n0AjKVdllrd5W:GCAn/etQYX0Ay7W

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1572-0-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/1572-2-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DpiveMox = "C:\\Windows\\system32\\dpvmox.exe"	7d70b51d015b65a316dd7cd7da52bb1c.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dpvmox.exe	7d70b51d015b65a316dd7cd7da52bb1c.exe
File opened for modification	C:\Windows\SysWOW64\dpvmox.exe	7d70b51d015b65a316dd7cd7da52bb1c.exe

C:\Users\Admin\AppData\Local\Temp\7d70b51d015b65a316dd7cd7da52bb1c.exe
"C:\Users\Admin\AppData\Local\Temp\7d70b51d015b65a316dd7cd7da52bb1c.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1572-2-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads