c18d97034347d268a6aef59c29909b6d55f4538920b86b98dfc594d1232ca272

Analysis

max time kernel
141s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88213b192ca84dcbdd8252707612e673.exe
Size

26KB
MD5

88213b192ca84dcbdd8252707612e673
SHA1

899910640f2005e6fbf9cf247091e4a1f001c6a6
SHA256

c18d97034347d268a6aef59c29909b6d55f4538920b86b98dfc594d1232ca272
SHA512

d8f6f380b7146e882e2300f4c47ad51b35d2fabb2e5567771892c1ce3906b049565ad82eb18faf4f034f369e9cc64497daea93638e8aa2170fdeabf328666b79
SSDEEP

768:xulqXcl7iCJG+6SHXOOd1vl43QjirrOT8ZJfYG:Ql7Nikb5OOLlD+IA9

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2204-0-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/2204-107-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/2204-221-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/2204-331-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\88213b192ca84dcbdd8252707612e673.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\88213b192ca84dcbdd8252707612e673.exe"	88213b192ca84dcbdd8252707612e673.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\a	88213b192ca84dcbdd8252707612e673.exe
File created	C:\Windows\i	88213b192ca84dcbdd8252707612e673.exe
File created	C:\Windows\j	88213b192ca84dcbdd8252707612e673.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C6E47F1B-E088-6A66-0FBD-C5FDD32BC653}	88213b192ca84dcbdd8252707612e673.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C6E47F1B-E088-6A66-0FBD-C5FDD32BC653}\LocalServer	88213b192ca84dcbdd8252707612e673.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C6E47F1B-E088-6A66-0FBD-C5FDD32BC653}\LocalServer\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\88213b192ca84dcbdd8252707612e673.exe"	88213b192ca84dcbdd8252707612e673.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C6E47F1B-E088-6A66-0FBD-C5FDD32BC653}\Data	88213b192ca84dcbdd8252707612e673.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C6E47F1B-E088-6A66-0FBD-C5FDD32BC653}\Data\ = 0000000000000000ac65c5aa6a3ebc65b990000000000000	88213b192ca84dcbdd8252707612e673.exe

C:\Users\Admin\AppData\Local\Temp\88213b192ca84dcbdd8252707612e673.exe
"C:\Users\Admin\AppData\Local\Temp\88213b192ca84dcbdd8252707612e673.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab739C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar73DE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2204-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2204-107-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2204-221-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2204-331-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads