9a376581f274337e1675177c7275b166f417681e6fb0a05bc0b1e8a82355f094

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cc982f5315d6572f5682a1f8e890ee5f.exe
Size

965KB
MD5

cc982f5315d6572f5682a1f8e890ee5f
SHA1

8f2ef1c82a4dace3b380ed79ca86054238405fc0
SHA256

9a376581f274337e1675177c7275b166f417681e6fb0a05bc0b1e8a82355f094
SHA512

9f2a9a4e8cb8fa883be4cbd93d055f462e110894007be68286466a27a070d20b501679077870c1a1f5c78d159e22410655d0f20fe99b13749a66744619847120
SSDEEP

24576:A/5e7XGZSYDa9PTpySih1v4yvQO+VQmKO5V4kCgZw3:A/ED85OJTk/PvQDH5V4kCg6

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2240	cc982f5315d6572f5682a1f8e890ee5f.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2240-0-0x0000000000400000-0x0000000000540000-memory.dmp	upx
behavioral1/memory/2240-4-0x0000000000400000-0x0000000000540000-memory.dmp	upx
behavioral1/memory/2240-5-0x0000000000400000-0x0000000000540000-memory.dmp	upx
behavioral1/memory/2240-7-0x0000000000400000-0x0000000000540000-memory.dmp	upx
behavioral1/memory/2240-27-0x00000000020D0000-0x00000000020DA000-memory.dmp	upx
behavioral1/memory/2240-34-0x0000000000400000-0x0000000000540000-memory.dmp	upx
behavioral1/memory/2240-42-0x0000000000400000-0x0000000000540000-memory.dmp	upx
behavioral1/memory/2240-43-0x0000000000400000-0x0000000000540000-memory.dmp	upx
behavioral1/memory/2240-44-0x0000000000400000-0x0000000000540000-memory.dmp	upx
behavioral1/memory/2240-52-0x0000000000400000-0x0000000000540000-memory.dmp	upx
behavioral1/memory/2240-77-0x0000000000400000-0x0000000000540000-memory.dmp	upx
behavioral1/memory/2240-78-0x0000000000400000-0x0000000000540000-memory.dmp	upx
behavioral1/memory/2240-79-0x0000000000400000-0x0000000000540000-memory.dmp	upx
behavioral1/memory/2240-80-0x0000000000400000-0x0000000000540000-memory.dmp	upx
behavioral1/memory/2240-99-0x0000000000400000-0x0000000000540000-memory.dmp	upx
behavioral1/memory/2240-108-0x0000000000400000-0x0000000000540000-memory.dmp	upx

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\P:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\X:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\T:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\U:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\B:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\I:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\L:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\O:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\Q:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\V:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\Y:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\Z:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\E:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\J:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\K:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\N:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\S:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\W:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\G:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\H:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\M:	cc982f5315d6572f5682a1f8e890ee5f.exe
File opened (read-only)	\??\R:	cc982f5315d6572f5682a1f8e890ee5f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2240	cc982f5315d6572f5682a1f8e890ee5f.exe

C:\Users\Admin\AppData\Local\Temp\cc982f5315d6572f5682a1f8e890ee5f.exe
"C:\Users\Admin\AppData\Local\Temp\cc982f5315d6572f5682a1f8e890ee5f.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\flh827A_tmp.gif

Filesize
2KB

MD5
21347b09c2a8542f06b984704dd7d007

SHA1
f115c1de53849351facb23dd614d1b470871937f

SHA256
0004d7888ff8fd3785d1bac30b2dd8c0da2ccd5822c8d3b3644dd07c6ac85493

SHA512
c2bcad44e689c8c52a4db27f4ce962db4245c2040e9337cf37dc9b5c5feadc2f4a68ed1dba519c32ea1653eb3d7f76321d1232b8569dbf3d4eaa02166789fdf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\flh97CF_tmp.mid

Filesize
31KB

MD5
e22139f16a222fa39c9703db3d9c478a

SHA1
c0239399eb6458c17dd36bce11857a73f5d40638

SHA256
6698e7724b504e320261bce01f28bd1f4d1e7e723d29d7cf87dad5887d7b2545

SHA512
d37c17430430ad20cd750df7fcd105df1b01100f9a3fd0ac99c4f859f1cdb16839bd8e7e3591b7c7eb2deddb8aba3a0446a2eb9bd41900521d8b8c9e5731f910

Download Submit
\Users\Admin\AppData\Local\Temp\dwlC40.tmp

Filesize
36KB

MD5
4fad8c569961b8645a190db6306e0765

SHA1
6cacc80978d17a73cfec3648fb351fdcfc580fc8

SHA256
b7872f933abb1ec4a2b56bce97c55d6bcfced70da22a2845b8cc52adc39e1759

SHA512
c77c89b8a6fbef284d6a6af2056cddb3d59eed212fbd0e052211af3c2beb419768fa5103a6b72fa12937ee771bdec8c202f44983dd8e2478765d16a7524473fa

Download Submit
memory/2240-0-0x0000000000400000-0x0000000000540000-memory.dmp

Filesize
1.2MB

Download
memory/2240-4-0x0000000000400000-0x0000000000540000-memory.dmp

Filesize
1.2MB

Download
memory/2240-5-0x0000000000400000-0x0000000000540000-memory.dmp

Filesize
1.2MB

Download
memory/2240-7-0x0000000000400000-0x0000000000540000-memory.dmp

Filesize
1.2MB

Download
memory/2240-11-0x00000000047E0000-0x00000000047EA000-memory.dmp

Filesize
40KB

Download
memory/2240-12-0x00000000047E0000-0x00000000047EA000-memory.dmp

Filesize
40KB

Download
memory/2240-10-0x00000000047E0000-0x00000000047EA000-memory.dmp

Filesize
40KB

Download
memory/2240-9-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/2240-15-0x0000000005CF0000-0x0000000005CFA000-memory.dmp

Filesize
40KB

Download
memory/2240-16-0x0000000005CF0000-0x0000000005CFA000-memory.dmp

Filesize
40KB

Download
memory/2240-14-0x0000000005CF0000-0x0000000005CFA000-memory.dmp

Filesize
40KB

Download
memory/2240-27-0x00000000020D0000-0x00000000020DA000-memory.dmp

Filesize
40KB

Download
memory/2240-28-0x00000000020D0000-0x00000000020DA000-memory.dmp

Filesize
40KB

Download
memory/2240-26-0x00000000020D0000-0x00000000020DA000-memory.dmp

Filesize
40KB

Download
memory/2240-25-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/2240-29-0x00000000047E0000-0x00000000047EA000-memory.dmp

Filesize
40KB

Download
memory/2240-33-0x0000000005CF0000-0x0000000005CFA000-memory.dmp

Filesize
40KB

Download
memory/2240-32-0x0000000005CF0000-0x0000000005CFA000-memory.dmp

Filesize
40KB

Download
memory/2240-34-0x0000000000400000-0x0000000000540000-memory.dmp

Filesize
1.2MB

Download
memory/2240-40-0x00000000020D0000-0x00000000020DA000-memory.dmp

Filesize
40KB

Download
memory/2240-41-0x00000000020D0000-0x00000000020DA000-memory.dmp

Filesize
40KB

Download
memory/2240-39-0x00000000020D0000-0x00000000020DA000-memory.dmp

Filesize
40KB

Download
memory/2240-42-0x0000000000400000-0x0000000000540000-memory.dmp

Filesize
1.2MB

Download
memory/2240-43-0x0000000000400000-0x0000000000540000-memory.dmp

Filesize
1.2MB

Download
memory/2240-44-0x0000000000400000-0x0000000000540000-memory.dmp

Filesize
1.2MB

Download
memory/2240-46-0x00000000042F0000-0x00000000042FA000-memory.dmp

Filesize
40KB

Download
memory/2240-50-0x0000000006700000-0x000000000670A000-memory.dmp

Filesize
40KB

Download
memory/2240-51-0x0000000006700000-0x000000000670A000-memory.dmp

Filesize
40KB

Download
memory/2240-49-0x0000000006700000-0x000000000670A000-memory.dmp

Filesize
40KB

Download
memory/2240-48-0x0000000006700000-0x000000000670A000-memory.dmp

Filesize
40KB

Download
memory/2240-52-0x0000000000400000-0x0000000000540000-memory.dmp

Filesize
1.2MB

Download
memory/2240-62-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/2240-63-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/2240-61-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/2240-60-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/2240-65-0x00000000042F0000-0x00000000042FA000-memory.dmp

Filesize
40KB

Download
memory/2240-66-0x00000000042F0000-0x00000000042FA000-memory.dmp

Filesize
40KB

Download
memory/2240-64-0x00000000042F0000-0x00000000042FA000-memory.dmp

Filesize
40KB

Download
memory/2240-70-0x0000000006700000-0x000000000670A000-memory.dmp

Filesize
40KB

Download
memory/2240-69-0x0000000006700000-0x000000000670A000-memory.dmp

Filesize
40KB

Download
memory/2240-71-0x0000000006700000-0x000000000670A000-memory.dmp

Filesize
40KB

Download
memory/2240-75-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/2240-76-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/2240-77-0x0000000000400000-0x0000000000540000-memory.dmp

Filesize
1.2MB

Download
memory/2240-78-0x0000000000400000-0x0000000000540000-memory.dmp

Filesize
1.2MB

Download
memory/2240-79-0x0000000000400000-0x0000000000540000-memory.dmp

Filesize
1.2MB

Download
memory/2240-80-0x0000000000400000-0x0000000000540000-memory.dmp

Filesize
1.2MB

Download
memory/2240-83-0x0000000004780000-0x000000000478A000-memory.dmp

Filesize
40KB

Download
memory/2240-82-0x0000000004780000-0x000000000478A000-memory.dmp

Filesize
40KB

Download
memory/2240-95-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/2240-93-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/2240-92-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/2240-94-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/2240-96-0x0000000004780000-0x000000000478A000-memory.dmp

Filesize
40KB

Download
memory/2240-99-0x0000000000400000-0x0000000000540000-memory.dmp

Filesize
1.2MB

Download
memory/2240-103-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/2240-104-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/2240-105-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/2240-106-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/2240-107-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/2240-108-0x0000000000400000-0x0000000000540000-memory.dmp

Filesize
1.2MB

Download