Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/03/2024, 01:35

General

  • Target

    c2205ce88f3f35433d63227225a4a991.exe

  • Size

    2.0MB

  • MD5

    c2205ce88f3f35433d63227225a4a991

  • SHA1

    d9f9c29c7f973d7262faae095e47f2e79e2e2d04

  • SHA256

    449c7a712601f7c932cafbbb3f17ad12799eb0f469a47fbe49ccde3bc4a41386

  • SHA512

    2693ca6208d00b379ab3ebff51ecd2b15141a17c4d0aa8406a54fd22f57cd0084b7de3595faeda8aca21a45b12569f5d7dd2e058638451b292a29cacb9a15ea8

  • SSDEEP

    49152:cIj0nsfLaXMngP3GQ7ai7D3xTgOxYwpKQbv69GGLzGbzMWhLbGQ7ai7D3xTgOxYj:jjSsfm8ngP3D2i7D3xkOxYwpKQbvwpuw

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c2205ce88f3f35433d63227225a4a991.exe
    "C:\Users\Admin\AppData\Local\Temp\c2205ce88f3f35433d63227225a4a991.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3520
    • C:\Users\Admin\AppData\Local\Temp\c2205ce88f3f35433d63227225a4a991.exe
      C:\Users\Admin\AppData\Local\Temp\c2205ce88f3f35433d63227225a4a991.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:64
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\c2205ce88f3f35433d63227225a4a991.exe" /TN v8Zki9cgdb8d /F
        3⤵
        • Creates scheduled task(s)
        PID:1992
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN v8Zki9cgdb8d > C:\Users\Admin\AppData\Local\Temp\5tULd0GNa.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4960
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN v8Zki9cgdb8d
          4⤵
            PID:1484
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 608
          3⤵
          • Program crash
          PID:1332
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 628
          3⤵
          • Program crash
          PID:676
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 64 -ip 64
      1⤵
        PID:1888
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 64 -ip 64
        1⤵
          PID:1104

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\5tULd0GNa.xml

          Filesize

          1KB

          MD5

          2e5b0780a37f3af1fbadf30494e4fcb0

          SHA1

          8d2088c8886124af60d22eb2e9a248dc5aba80d2

          SHA256

          151df90327e49445fe554788a88fe051462aec76ece377c4d13bc6d54a519647

          SHA512

          488e39bcdce73ca72fc2d3e13608ee3c345f00bf395a64b949a38ec19eb31222a293d327bb057063684d0518babe33cf6f4abdb44ce05e1ff145feb58573fade

        • C:\Users\Admin\AppData\Local\Temp\c2205ce88f3f35433d63227225a4a991.exe

          Filesize

          636KB

          MD5

          12821b25dcc60ef80ef61b1e6bbf47e6

          SHA1

          ed3e7b9362df1ee35ebf45c017cfca0c0373a986

          SHA256

          8d4e7b6a7765ce880cd7c91f44adcf3fcaf818318303a00d87320086d9f4d1e4

          SHA512

          5e7475b8d9b7850d96581501e22ef915bbde4f88736f6a5c9f08973d0e5a249e62329bab09f6b2b0f523d2de98385db551a8a6c8af02e0a8b457ba37f71c3856

        • memory/64-15-0x00000000016D0000-0x000000000174E000-memory.dmp

          Filesize

          504KB

        • memory/64-17-0x0000000000400000-0x000000000065C000-memory.dmp

          Filesize

          2.4MB

        • memory/64-22-0x0000000000400000-0x000000000045B000-memory.dmp

          Filesize

          364KB

        • memory/64-24-0x00000000004B0000-0x000000000051B000-memory.dmp

          Filesize

          428KB

        • memory/64-40-0x0000000000400000-0x000000000065C000-memory.dmp

          Filesize

          2.4MB

        • memory/3520-0-0x0000000000400000-0x000000000065C000-memory.dmp

          Filesize

          2.4MB

        • memory/3520-1-0x0000000000400000-0x000000000046B000-memory.dmp

          Filesize

          428KB

        • memory/3520-2-0x0000000025050000-0x00000000250CE000-memory.dmp

          Filesize

          504KB

        • memory/3520-13-0x0000000000400000-0x000000000046B000-memory.dmp

          Filesize

          428KB