Overview

overview

7

Static

static

7

8d82b1a237...58.exe

windows7-x64

7

8d82b1a237...58.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    140s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03/02/2024, 22:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    8d82b1a23752d39ac563cfc8440cd558.exe

  • Size

    17KB

  • MD5

    8d82b1a23752d39ac563cfc8440cd558

  • SHA1

    f1d2e5e9371e3b40af212bc9a847bdc1bedda352

  • SHA256

    ea619a2cfb8305c7ef27f8ed0d233dc03d808bb541164e56014a0683145a5311

  • SHA512

    9849270ca318b9a2f687f1beab1bdafd9b91dc0a3ef80961f90b30573b8a7b8306dad119845c65a1096d2723614b299bcab669d89618ad1f405c0bd9e1a7e8d1

  • SSDEEP

    384:fVyLwWJibspKZrumufgq/a7vv2lHE/+OM:fVOmgQZaxfb+aHf

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1072
      • C:\Users\Admin\AppData\Local\Temp\8d82b1a23752d39ac563cfc8440cd558.exe
        "C:\Users\Admin\AppData\Local\Temp\8d82b1a23752d39ac563cfc8440cd558.exe"
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2072

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1072-3-0x0000000002E60000-0x0000000002E61000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2072-0-0x0000000000400000-0x000000000040C000-memory.dmp

            Filesize

            48KB

            Download

          • memory/2072-6-0x0000000000400000-0x000000000040C000-memory.dmp

            Filesize

            48KB

            Download