7e03c7dcef3418dc78acd0eeaceb3cf12df49164b8c4f1f9edfe694db058501f

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1cc23571c357039d9683c4c309b8fbf.exe
Size

201KB
MD5

c1cc23571c357039d9683c4c309b8fbf
SHA1

e8c55bd85cc0576bdf72cc2cd4ae1ef81248525d
SHA256

7e03c7dcef3418dc78acd0eeaceb3cf12df49164b8c4f1f9edfe694db058501f
SHA512

d87116e71e1fc69d68a75cf5b4f4fef3726ca5b923eb2e5c1ca885be33f3a3c2d7aa05334ab9202104b5ff924970cbfbc88766367adee0c7259c4879c2d84d8a
SSDEEP

3072:Yt7PnpFZ5HhBxOWjcP5v90Ny+nN9rii/it/t9fOkDjQyox4qp0nwfKnqex:YtzZ/YD0Ny+zei/FkPQyoKqpRKqe

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2852	Java.exe

Loads dropped DLL 5 IoCs

pid	Process
2924	c1cc23571c357039d9683c4c309b8fbf.exe
2924	c1cc23571c357039d9683c4c309b8fbf.exe
2536	WerFault.exe
2536	WerFault.exe
2536	WerFault.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2924-0-0x0000000000400000-0x0000000000496000-memory.dmp	upx
behavioral1/files/0x0007000000014bd7-9.dat	upx
behavioral1/memory/2924-5-0x00000000004B0000-0x0000000000546000-memory.dmp	upx
behavioral1/memory/2852-18-0x0000000000400000-0x0000000000496000-memory.dmp	upx
behavioral1/memory/2924-17-0x0000000000400000-0x0000000000496000-memory.dmp	upx
behavioral1/memory/2924-23-0x0000000000400000-0x0000000000496000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2536	2852	WerFault.exe	30

Runs net.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2980	2924	c1cc23571c357039d9683c4c309b8fbf.exe	28
PID 2924 wrote to memory of 2980	2924	c1cc23571c357039d9683c4c309b8fbf.exe	28
PID 2924 wrote to memory of 2980	2924	c1cc23571c357039d9683c4c309b8fbf.exe	28
PID 2924 wrote to memory of 2980	2924	c1cc23571c357039d9683c4c309b8fbf.exe	28
PID 2924 wrote to memory of 2852	2924	c1cc23571c357039d9683c4c309b8fbf.exe	30
PID 2924 wrote to memory of 2852	2924	c1cc23571c357039d9683c4c309b8fbf.exe	30
PID 2924 wrote to memory of 2852	2924	c1cc23571c357039d9683c4c309b8fbf.exe	30
PID 2924 wrote to memory of 2852	2924	c1cc23571c357039d9683c4c309b8fbf.exe	30
PID 2924 wrote to memory of 2852	2924	c1cc23571c357039d9683c4c309b8fbf.exe	30
PID 2924 wrote to memory of 2852	2924	c1cc23571c357039d9683c4c309b8fbf.exe	30
PID 2924 wrote to memory of 2852	2924	c1cc23571c357039d9683c4c309b8fbf.exe	30
PID 2852 wrote to memory of 2868	2852	Java.exe	31
PID 2852 wrote to memory of 2868	2852	Java.exe	31
PID 2852 wrote to memory of 2868	2852	Java.exe	31
PID 2852 wrote to memory of 2868	2852	Java.exe	31
PID 2868 wrote to memory of 2656	2868	net.exe	34
PID 2868 wrote to memory of 2656	2868	net.exe	34
PID 2868 wrote to memory of 2656	2868	net.exe	34
PID 2868 wrote to memory of 2656	2868	net.exe	34
PID 2980 wrote to memory of 2616	2980	net.exe	33
PID 2980 wrote to memory of 2616	2980	net.exe	33
PID 2980 wrote to memory of 2616	2980	net.exe	33
PID 2980 wrote to memory of 2616	2980	net.exe	33
PID 2852 wrote to memory of 2536	2852	Java.exe	35
PID 2852 wrote to memory of 2536	2852	Java.exe	35
PID 2852 wrote to memory of 2536	2852	Java.exe	35
PID 2852 wrote to memory of 2536	2852	Java.exe	35

C:\Users\Admin\AppData\Local\Temp\c1cc23571c357039d9683c4c309b8fbf.exe
"C:\Users\Admin\AppData\Local\Temp\c1cc23571c357039d9683c4c309b8fbf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\net.exe
  net stop SharedAccess
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SharedAccess
    3⤵
    PID:2616
- C:\Arquivos de programas\Arquivos comuns\Java.exe
  "C:\Arquivos de programas\Arquivos comuns\Java.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      PID:2656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 456
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Arquivos de Programas\Arquivos comuns\Java.exe

Filesize
201KB

MD5
c1cc23571c357039d9683c4c309b8fbf

SHA1
e8c55bd85cc0576bdf72cc2cd4ae1ef81248525d

SHA256
7e03c7dcef3418dc78acd0eeaceb3cf12df49164b8c4f1f9edfe694db058501f

SHA512
d87116e71e1fc69d68a75cf5b4f4fef3726ca5b923eb2e5c1ca885be33f3a3c2d7aa05334ab9202104b5ff924970cbfbc88766367adee0c7259c4879c2d84d8a

Download Submit
memory/2852-13-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2852-18-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2924-0-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2924-1-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2924-5-0x00000000004B0000-0x0000000000546000-memory.dmp

Filesize
600KB

Download
memory/2924-12-0x00000000004B0000-0x0000000000546000-memory.dmp

Filesize
600KB

Download
memory/2924-17-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2924-23-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download