Overview

overview

10

Static

static

3

85cc500e9d...de.exe

windows7-x64

10

85cc500e9d...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-02-2024 03:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    85cc500e9d627adf6c993b35c10e32de.exe

  • Size

    414KB

  • MD5

    85cc500e9d627adf6c993b35c10e32de

  • SHA1

    9f22a7e0577d657e418d93e9c2f501ffd94a50e6

  • SHA256

    d6be4a9ced2bb27e8d077642c3ca0473d1d63123935719e293a226bffec8fcd4

  • SHA512

    ecda6ab10dfcc208030b01078768a6282e1df6b14963b86ffec824b81a16eccc2a1144353c21ba60436ac4967776b1418be51314908b514f8efd36b2ac8b0624

  • SSDEEP

    12288:xEU3npqLuOCtLpq7vnGjp2Vofyr3t/Fwh0uZatfGRxSI:xEU3pqLXEUQ2VofyxFwh0N

Score
10/10
evasionpersistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Program crash 2 IoCs
  • Modifies data under HKEY_USERS 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\85cc500e9d627adf6c993b35c10e32de.exe
    "C:\Users\Admin\AppData\Local\Temp\85cc500e9d627adf6c993b35c10e32de.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4080
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 892
      2⤵
      • Program crash
      PID:1132
    • C:\ProgramData\fJ07501MkNeP07501\fJ07501MkNeP07501.exe
      "C:\ProgramData\fJ07501MkNeP07501\fJ07501MkNeP07501.exe" "C:\Users\Admin\AppData\Local\Temp\85cc500e9d627adf6c993b35c10e32de.exe"
      2⤵
      • Modifies security service
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:4024
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 888
        3⤵
        • Program crash
        PID:4108
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4080 -ip 4080
    1⤵
      PID:552
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4024 -ip 4024
      1⤵
        PID:3332
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        PID:4536
      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
        1⤵
        • Modifies data under HKEY_USERS
        PID:3656
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        PID:1256
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        PID:3400
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        PID:3556
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        PID:2652
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        PID:848

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\fJ07501MkNeP07501\fJ07501MkNeP07501.exe
        Filesize

        414KB

        MD5

        c90aa7895fd2b1816b719e940c60469b

        SHA1

        688078c3e003c7e885b45a050ea6c60193c6bdb3

        SHA256

        b4228d6a93c2a24c0f5f6166cddb50da14b153d1d4a2ea145943c7b2760e0015

        SHA512

        81d28fe5a1cdacc06150d612c2b421424c6ade756f7af1dfb1e634be929205db62e5182a7e6b3d2c4ffdcca73348e42272ae3786f8c25bb8bd32e74d80e1d950

        Download Submit

      • memory/4024-22-0x0000000000400000-0x00000000004D2000-memory.dmp

        Filesize

        840KB

        Download

      • memory/4024-28-0x0000000000400000-0x00000000004D2000-memory.dmp

        Filesize

        840KB

        Download

      • memory/4024-35-0x0000000000400000-0x00000000004D2000-memory.dmp

        Filesize

        840KB

        Download

      • memory/4024-36-0x0000000000400000-0x00000000004D2000-memory.dmp

        Filesize

        840KB

        Download

      • memory/4024-37-0x0000000000400000-0x00000000004D2000-memory.dmp

        Filesize

        840KB

        Download

      • memory/4080-0-0x0000000002240000-0x0000000002243000-memory.dmp

        Filesize

        12KB

        Download

      • memory/4080-1-0x0000000000400000-0x00000000004D2000-memory.dmp

        Filesize

        840KB

        Download

      • memory/4080-10-0x0000000000400000-0x00000000004D2000-memory.dmp

        Filesize

        840KB

        Download

      • memory/4080-20-0x0000000000400000-0x00000000004D2000-memory.dmp

        Filesize

        840KB

        Download