66a470eabf3779bdf77f2282611e8993caa5d89f7db757cf1b1a177cdda63e23

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f89b8e7d5b2deb415f66feecda40aa2.exe
Size

409KB
MD5

7f89b8e7d5b2deb415f66feecda40aa2
SHA1

9d26551521abf980412215f6596e19823ffe48d0
SHA256

66a470eabf3779bdf77f2282611e8993caa5d89f7db757cf1b1a177cdda63e23
SHA512

63cea3c3513ff10fa1cb91b4e46ad7276ecb8fad70884110c86360c48cbcdb770f22d9924aa207aaac23d35407d7d194a1fd874a6e9bb904bb0501fa17f81479
SSDEEP

12288:YWNXzBLHbnpkB06HWifbdv4UwZq9SL7eSFEsboS:YWNDJbn8BHnpAUwZiSL7ji

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2244	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2868	ukxuexh.exe

Loads dropped DLL 2 IoCs

pid	Process
2244	cmd.exe
2868	ukxuexh.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1716-0-0x0000000001000000-0x00000000010B5000-memory.dmp	upx
behavioral1/files/0x000a000000012253-7.dat	upx
behavioral1/memory/2868-10-0x0000000001000000-0x00000000010B5000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2740	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2752	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2244	1716	7f89b8e7d5b2deb415f66feecda40aa2.exe	28
PID 1716 wrote to memory of 2244	1716	7f89b8e7d5b2deb415f66feecda40aa2.exe	28
PID 1716 wrote to memory of 2244	1716	7f89b8e7d5b2deb415f66feecda40aa2.exe	28
PID 1716 wrote to memory of 2244	1716	7f89b8e7d5b2deb415f66feecda40aa2.exe	28
PID 2244 wrote to memory of 2740	2244	cmd.exe	30
PID 2244 wrote to memory of 2740	2244	cmd.exe	30
PID 2244 wrote to memory of 2740	2244	cmd.exe	30
PID 2244 wrote to memory of 2740	2244	cmd.exe	30
PID 2244 wrote to memory of 2752	2244	cmd.exe	32
PID 2244 wrote to memory of 2752	2244	cmd.exe	32
PID 2244 wrote to memory of 2752	2244	cmd.exe	32
PID 2244 wrote to memory of 2752	2244	cmd.exe	32
PID 2244 wrote to memory of 2868	2244	cmd.exe	33
PID 2244 wrote to memory of 2868	2244	cmd.exe	33
PID 2244 wrote to memory of 2868	2244	cmd.exe	33
PID 2244 wrote to memory of 2868	2244	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\7f89b8e7d5b2deb415f66feecda40aa2.exe
"C:\Users\Admin\AppData\Local\Temp\7f89b8e7d5b2deb415f66feecda40aa2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1716 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7f89b8e7d5b2deb415f66feecda40aa2.exe" & start C:\Users\Admin\AppData\Local\ukxuexh.exe -f
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /pid 1716
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.1
    3⤵
    - Runs ping.exe
    PID:2752
- - C:\Users\Admin\AppData\Local\ukxuexh.exe
    C:\Users\Admin\AppData\Local\ukxuexh.exe -f
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\ukxuexh.exe

Filesize
409KB

MD5
7f89b8e7d5b2deb415f66feecda40aa2

SHA1
9d26551521abf980412215f6596e19823ffe48d0

SHA256
66a470eabf3779bdf77f2282611e8993caa5d89f7db757cf1b1a177cdda63e23

SHA512
63cea3c3513ff10fa1cb91b4e46ad7276ecb8fad70884110c86360c48cbcdb770f22d9924aa207aaac23d35407d7d194a1fd874a6e9bb904bb0501fa17f81479

Download Submit
memory/1716-0-0x0000000001000000-0x00000000010B5000-memory.dmp

Filesize
724KB

Download
memory/1716-1-0x00000000007E0000-0x000000000086D000-memory.dmp

Filesize
564KB

Download
memory/1716-2-0x00000000003D0000-0x0000000000417000-memory.dmp

Filesize
284KB

Download
memory/1716-3-0x0000000001000000-0x00000000010B5000-memory.dmp

Filesize
724KB

Download
memory/1716-4-0x0000000000250000-0x0000000000252000-memory.dmp

Filesize
8KB

Download
memory/1716-6-0x0000000001000000-0x00000000010B5000-memory.dmp

Filesize
724KB

Download
memory/2868-10-0x0000000001000000-0x00000000010B5000-memory.dmp

Filesize
724KB

Download
memory/2868-11-0x0000000001000000-0x00000000010B5000-memory.dmp

Filesize
724KB

Download
memory/2868-14-0x0000000000F40000-0x0000000000FF5000-memory.dmp

Filesize
724KB

Download
memory/2868-12-0x0000000000280000-0x0000000000282000-memory.dmp

Filesize
8KB

Download
memory/2868-15-0x0000000001000000-0x00000000010B5000-memory.dmp

Filesize
724KB

Download