Analysis

  • max time kernel
    143s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/01/2024, 03:30

General

  • Target

    7ec585796b714cdc7d1fbf3c436fb9ea.exe

  • Size

    544KB

  • MD5

    7ec585796b714cdc7d1fbf3c436fb9ea

  • SHA1

    0d9742e3356f0c2e9ad8c5c6e48530f4d64c1ce0

  • SHA256

    74dc9093163ce8daca46f48987fd7f971f1f4f89cc98c98f673293cc71d78b7b

  • SHA512

    79253470997b89a44f12047a9e6a580d7c705ebd164b443ebaf68b47f7d8aa32d805f54a5ff26538170c882cd852b7d209b3cb83a467db9399f0a28b1c53d5b4

  • SSDEEP

    12288:6GuWm0QRVRdgFkEXIc0pg3xTX2ep3vWQrWKr:Xc7dgadoTXFdeaWe

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ec585796b714cdc7d1fbf3c436fb9ea.exe
    "C:\Users\Admin\AppData\Local\Temp\7ec585796b714cdc7d1fbf3c436fb9ea.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:3460
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x4dc 0x504
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSO8CY24\px[1].js

    Filesize

    476B

    MD5

    d2183968f9080b37babfeba3ccf10df2

    SHA1

    24b9cf589ee6789e567fac3ae5acfc25826d00c6

    SHA256

    4d9b83714539f82372e1e0177924bcb5180b75148e22d6725468fd2fb6f96bcc

    SHA512

    0e16d127a199a4238138eb99a461adf2665cee4f803d63874b4bcef52301d0ecd1d2eb71af3f77187916fe04c5f9b152c51171131c2380f31ca267a0a46d2a42

  • memory/3460-27-0x0000000000400000-0x0000000000596000-memory.dmp

    Filesize

    1.6MB

  • memory/3460-29-0x0000000000400000-0x0000000000596000-memory.dmp

    Filesize

    1.6MB

  • memory/3460-22-0x0000000000400000-0x0000000000596000-memory.dmp

    Filesize

    1.6MB

  • memory/3460-23-0x0000000000400000-0x0000000000596000-memory.dmp

    Filesize

    1.6MB

  • memory/3460-24-0x0000000000400000-0x0000000000596000-memory.dmp

    Filesize

    1.6MB

  • memory/3460-25-0x0000000000400000-0x0000000000596000-memory.dmp

    Filesize

    1.6MB

  • memory/3460-10-0x0000000000400000-0x0000000000596000-memory.dmp

    Filesize

    1.6MB

  • memory/3460-26-0x0000000000400000-0x0000000000596000-memory.dmp

    Filesize

    1.6MB

  • memory/3460-28-0x0000000000400000-0x0000000000596000-memory.dmp

    Filesize

    1.6MB

  • memory/3460-0-0x0000000000400000-0x0000000000596000-memory.dmp

    Filesize

    1.6MB

  • memory/3460-30-0x0000000000400000-0x0000000000596000-memory.dmp

    Filesize

    1.6MB

  • memory/3460-31-0x0000000000400000-0x0000000000596000-memory.dmp

    Filesize

    1.6MB

  • memory/3460-32-0x0000000000400000-0x0000000000596000-memory.dmp

    Filesize

    1.6MB

  • memory/3460-33-0x0000000000400000-0x0000000000596000-memory.dmp

    Filesize

    1.6MB

  • memory/3460-34-0x0000000000400000-0x0000000000596000-memory.dmp

    Filesize

    1.6MB

  • memory/3460-35-0x0000000000400000-0x0000000000596000-memory.dmp

    Filesize

    1.6MB