Overview

overview

7

Static

static

7

4f1f9c7303...35.exe

windows7-x64

7

4f1f9c7303...35.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    88s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 22:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4f1f9c7303756d3e232df9ad35c12135.exe

  • Size

    359KB

  • MD5

    4f1f9c7303756d3e232df9ad35c12135

  • SHA1

    f5ecd291d0cd3ba535c007f962c151dde199db17

  • SHA256

    41bcc58bd1737a7c9eddd9b997e66abc021d64c81b8045b6a6ab8a6856a7f120

  • SHA512

    df61af895a5da869f058e2a6133294f6df790bf25bfda451391d24d903148c1d5ed8be9cb8992aab92ef9dad16ed0fc3b27ac503963abefe331349580c984ffd

  • SSDEEP

    6144:vhbZ5hMTNFf8LAurlEzAX7oAwfSZ4sXUzQIlS:ZtXMzqrllX7XwfEI8

Score
7/10
persistenceupx

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • UPX packed file 44 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 26 IoCs
    persistence
  • Modifies registry class 54 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f1f9c7303756d3e232df9ad35c12135.exe
    "C:\Users\Admin\AppData\Local\Temp\4f1f9c7303756d3e232df9ad35c12135.exe"
    1⤵
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3568
    • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202.exe
      c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3720
      • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202a.exe
        c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202a.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1928
        • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202b.exe
          c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202b.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3536
          • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202c.exe
            c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202c.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:5008
            • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202d.exe
              c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202d.exe
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:5092
              • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202e.exe
                c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202e.exe
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:3456
                • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202f.exe
                  c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202f.exe
                  8⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:3276
                  • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202g.exe
                    c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202g.exe
                    9⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:1476
                    • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202h.exe
                      c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202h.exe
                      10⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:1392
                      • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202i.exe
                        c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202i.exe
                        11⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:4444
                        • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202j.exe
                          c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202j.exe
                          12⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:3020
                          • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202k.exe
                            c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202k.exe
                            13⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:4320
                            • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202l.exe
                              c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202l.exe
                              14⤵
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:2984
                              • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202m.exe
                                c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202m.exe
                                15⤵
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Modifies registry class
                                • Suspicious use of WriteProcessMemory
                                PID:4836
                                • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202n.exe
                                  c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202n.exe
                                  16⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Modifies registry class
                                  • Suspicious use of WriteProcessMemory
                                  PID:2100
                                  • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202o.exe
                                    c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202o.exe
                                    17⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Modifies registry class
                                    • Suspicious use of WriteProcessMemory
                                    PID:2712
                                    • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202p.exe
                                      c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202p.exe
                                      18⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:4832
                                      • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202q.exe
                                        c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202q.exe
                                        19⤵
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Modifies registry class
                                        • Suspicious use of WriteProcessMemory
                                        PID:3932
                                        • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202r.exe
                                          c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202r.exe
                                          20⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Modifies registry class
                                          • Suspicious use of WriteProcessMemory
                                          PID:4608
                                          • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202s.exe
                                            c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202s.exe
                                            21⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Modifies registry class
                                            • Suspicious use of WriteProcessMemory
                                            PID:5012
                                            • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202t.exe
                                              c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202t.exe
                                              22⤵
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • Modifies registry class
                                              • Suspicious use of WriteProcessMemory
                                              PID:3380
                                              • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202u.exe
                                                c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202u.exe
                                                23⤵
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                • Modifies registry class
                                                PID:4216
                                                • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202v.exe
                                                  c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202v.exe
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • Modifies registry class
                                                  PID:1012
                                                  • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202w.exe
                                                    c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202w.exe
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • Modifies registry class
                                                    PID:2684
                                                    • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202x.exe
                                                      c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202x.exe
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Adds Run key to start application
                                                      • Modifies registry class
                                                      PID:4056
                                                      • \??\c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202y.exe
                                                        c:\users\admin\appdata\local\temp\4f1f9c7303756d3e232df9ad35c12135_3202y.exe
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        PID:4376

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\4f1f9c7303756d3e232df9ad35c12135_3202.exe
    Filesize

    359KB

    MD5

    f855debaeaa6268ef4e03c25e1b1190c

    SHA1

    c440fee1d382048648ea777bfc2a1cc1d970932a

    SHA256

    09b337e0c453b7dab30e13a352ab5fc8f37feb05c0d5d2c4f94b765a0c411aa6

    SHA512

    801919cf42e6824a13e3046385589750c28d3c636407e6c56cd57122ed58bab755c31e5ad8639a6e18f7f01da773c2e846a1f1fccb264651d7bd65a30edf8f79

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\4f1f9c7303756d3e232df9ad35c12135_3202l.exe
    Filesize

    359KB

    MD5

    819baa0a3e956cbff1bc2f98917764e7

    SHA1

    97021ffaff2aa6165c8c73120b04b74ee2edf58a

    SHA256

    25cc19e64d26c1b9fb86494e7a79fba95484765fcb1573fc1ae553000ba936e7

    SHA512

    c7a66b117cfdb7cb3ef5d0d42ae4dca2ce301f7bb19a829c3540d516817f12097ac41fc7154700cffa993e2eb2291e0c077402275b128d6433fc67cf8a98c63e

    Download Submit

  • memory/1012-227-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/1012-217-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/1392-99-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/1476-198-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/1476-77-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/1928-35-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/1928-19-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/2100-148-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/2684-244-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/2712-160-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/2712-151-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/2984-223-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/2984-128-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/3020-112-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/3276-178-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/3276-73-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/3380-207-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/3456-67-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/3536-29-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/3536-141-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/3568-9-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/3568-0-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/3720-20-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/3720-15-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/3932-179-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/4056-245-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/4216-225-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/4216-213-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/4320-118-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/4320-120-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/4376-250-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/4376-248-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/4444-101-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/4608-186-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/4832-167-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/4836-131-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/4836-228-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/5008-54-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/5008-44-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/5012-194-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/5012-249-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/5092-58-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/5092-48-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download