Analysis

  • max time kernel
    142s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/02/2024, 22:12

General

  • Target

    acfc4b57c77e1b57095853d5ee956a5b.exe

  • Size

    1.6MB

  • MD5

    acfc4b57c77e1b57095853d5ee956a5b

  • SHA1

    ea93a68691c04d52165f9b046552e36fb36836e5

  • SHA256

    5cd09e0e2663cab9e7493e41df346499a13d0684c8d4263007b837fc32e5c59a

  • SHA512

    1bfc7228c04cb68b00ba52c55e429331942f6510f5079f1f4ff7c72f35f77fc8e0d9748db60a95fc6bc61f6d590626acf67d9b66a1c953e13aed2a4438977ce4

  • SSDEEP

    49152:5JGsGG1ylq8PocZpUPeGtxPQNeHn++LOrS7cTry/KwgTU9Ofe:HOycMPBf4NeH+FrSQTryNySOfe

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\acfc4b57c77e1b57095853d5ee956a5b.exe
    "C:\Users\Admin\AppData\Local\Temp\acfc4b57c77e1b57095853d5ee956a5b.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2816

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\uDwn-AQD2\Language.lng

          Filesize

          3KB

          MD5

          a76da3ce02ce785f23575e1e074d8d01

          SHA1

          b2c225e4dd943e9527cbbdc230a8335e22fd7596

          SHA256

          90137377483795388c2b95d84c7a2f149a5f78af901233039a81ac8d02901934

          SHA512

          0d6693a6e65b98c45888e73c58d2a08769102e94b5b96ca3bbed9b454d03a3c4d224361912bb3298269c08ac744d2db887e84bedf2356753d4d7c8d563bd80ec

        • C:\Users\Admin\AppData\Local\Temp\uDwn-AQD2\config.udc

          Filesize

          1KB

          MD5

          2f3c07128942958c533ae6a7a21512bd

          SHA1

          bb4c78582b70fc137893dd5866cf94b49a533714

          SHA256

          b61db76f8d31a30457ed7495a2e0eb988b040656ed530e8a8e4254edad3a1725

          SHA512

          d836ece0e2f3bc0bc4f1f6d96349b102a9eeea5d74ca0d7d4fbcab795196106a5af9eb115f801927f40a9d9312a9196a928a80aada812bc597a2c516a32590a4

        • memory/2816-0-0x0000000000400000-0x0000000000763000-memory.dmp

          Filesize

          3.4MB

        • memory/2816-1-0x0000000000250000-0x0000000000251000-memory.dmp

          Filesize

          4KB

        • memory/2816-111-0x0000000000270000-0x0000000000271000-memory.dmp

          Filesize

          4KB

        • memory/2816-112-0x0000000000400000-0x0000000000763000-memory.dmp

          Filesize

          3.4MB

        • memory/2816-114-0x0000000000250000-0x0000000000251000-memory.dmp

          Filesize

          4KB