bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35

max time kernel
138s
max time network
306s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
Size

1.9MB
MD5

97e5f2c04baad060d0169b7d76cfa5de
SHA1

00d5d0699bf1ccddf28fbd9eeb6ed9aaa8bc320b
SHA256

bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35
SHA512

56fabb8ec6be3cdb582214c9519a3ae59d4b4d0e97262c646cdbc6ac54d0f0fddb692e5fbebb6589ce2e63cae4f4567812aa911765431d95d412d4a86de82e9f
SSDEEP

49152:gFnov1UndgBEDJnUJFLIzBAxmOcgSp/QDsYiX:MnovedqGoWFAxP2QHi

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/1600-3-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-4-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-21-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-23-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-25-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-34-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-35-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-39-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-40-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-49-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-52-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-61-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-71-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-74-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-75-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-86-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-85-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-93-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-106-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-109-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-105-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-104-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-101-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-100-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-99-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-98-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-92-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-103-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-90-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-89-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-88-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-97-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-83-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-87-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-84-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-78-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-80-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1600-79-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 696 set thread context of 1600	696	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1600	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
1600	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
1600	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
1600	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
1600	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
1600	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 1600	696	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	93
PID 696 wrote to memory of 1600	696	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	93
PID 696 wrote to memory of 1600	696	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	93
PID 696 wrote to memory of 1600	696	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	93
PID 696 wrote to memory of 1600	696	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	93
PID 696 wrote to memory of 1600	696	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	93
PID 696 wrote to memory of 1600	696	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	93
PID 696 wrote to memory of 1600	696	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	93

C:\Users\Admin\AppData\Local\Temp\bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
"C:\Users\Admin\AppData\Local\Temp\bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:696
- C:\Users\Admin\AppData\Local\Temp\bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
  "C:\Users\Admin\AppData\Local\Temp\bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:1600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5960 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

Filesize
2.6MB

MD5
9bae03d3dc0f5cfd40507ee03ba5a765

SHA1
bbb2ea791c2e53e615f7c4b17246b4d465e6a4fe

SHA256
ff1af3cc0eff747f5425287eea2910d8d69cd9d30af5a90a41a03a023bb0313f

SHA512
2263b74eefd835f92a085f1b35e156b79c37996b1976d6b93ad94cfce8454411131d4b3dc1d3d3cee175b37d05433f3061060023219d7d3da86e034e510b7b81

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
9.5MB

MD5
f0c89aea5ff7c0b2aefe61a25364ee45

SHA1
82ce6af5b0e45a02678bc823071c9c6bb50b0a2f

SHA256
dc08b2fcc40dccb75fcc67a25920336f06f8a74b301993569bc1d05e96810966

SHA512
9b49c9936a547373af3a2c889d4e82c1fd2cc3fa1c12583388db77bfe7fb43fcfe9cbe115fefd2cf66187871bb8f99b4da7b28199add9c2869ddf6a3a045a126

Download Submit
memory/696-1-0x0000000002BA0000-0x0000000002D62000-memory.dmp

Filesize
1.8MB

Download
memory/696-2-0x0000000002D70000-0x0000000002F27000-memory.dmp

Filesize
1.7MB

Download
memory/1600-3-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-4-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-21-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-23-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-25-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-34-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-35-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-39-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-40-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-49-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-52-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-61-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-71-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-74-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-75-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-86-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-85-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-93-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-106-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-109-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-105-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-104-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-101-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-100-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-99-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-98-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-92-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-103-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-90-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-89-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-88-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-97-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-83-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-87-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-84-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-78-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-80-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1600-79-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download