07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8

Resubmissions

09/04/2024, 10:01

240409-l2cehacb92 7

09/04/2024, 10:01

09/04/2024, 10:00

09/04/2024, 10:00

02/02/2024, 03:32

Analysis

max time kernel
216s
max time network
597s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe
Size

1.9MB
MD5

fec37d48f184bc1d09ce85e2ce417aab
SHA1

dc3d58d79ba2e72ed78acb260cd70ef6a04ee3d8
SHA256

07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8
SHA512

ce9e0f2abc1378c450893ceeb1346218a951c70276732e1a9b54995b897d4b43798e074e722b360581402112548976d09417df0498c6dbc17a0e72e44cef0dbb
SSDEEP

49152:R5jTWFcRVUjH+9T7louxwP9UY2s1i5+tZPW2MpryeUUs:R5jxwe9FqOY2s1TPW2KryO

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Contacts a large (730) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

UPX packed file 38 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2940-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-10-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-11-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-40-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-41-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-42-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-43-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-47-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-48-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-49-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-50-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-52-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-54-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-56-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-59-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-60-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-69-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-68-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-73-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-74-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-78-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-80-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-85-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-97-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-83-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-77-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2940-99-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2578	drive.google.com
2541	drive.google.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1888 set thread context of 2940	1888	07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2940	07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe
2940	07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe
2940	07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2940	1888	07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe	28
PID 1888 wrote to memory of 2940	1888	07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe	28
PID 1888 wrote to memory of 2940	1888	07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe	28
PID 1888 wrote to memory of 2940	1888	07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe	28
PID 1888 wrote to memory of 2940	1888	07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe	28
PID 1888 wrote to memory of 2940	1888	07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe	28
PID 1888 wrote to memory of 2940	1888	07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe	28
PID 1888 wrote to memory of 2940	1888	07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe	28
PID 1888 wrote to memory of 2940	1888	07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe	28

C:\Users\Admin\AppData\Local\Temp\07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe
"C:\Users\Admin\AppData\Local\Temp\07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe
  "C:\Users\Admin\AppData\Local\Temp\07b2944da083c2d739d187b1b564f355a42154c0a9ad8eb8aa0767d283f431a8.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

Filesize
2.6MB

MD5
21112c87b4bb2b0bb8004c1f1653d36e

SHA1
31aed7e1843c4cc528931710ba578f909e71d764

SHA256
556b87267249b63a0e4ab4e0afd7924e88f72e036c55c1e18c40c7889762449c

SHA512
b95c5603d090c79c8e67bd8f6f5cedffd2d0c5b1d453489d99733997ff2722d83a138c925790ed4341d61756f859ff5523ef54674553b6602b730a7042eccb2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
6.7MB

MD5
10a82889ac5fe81fa4c84f035c167ed1

SHA1
d752cce3e0e46d0c5620bcd718bdf6bfcf758f6e

SHA256
6071ee8e85a247c77f74c9fb6071c6187f00bf151128c261bf11598d14eb147a

SHA512
3cd20b69d657d656dea4873c368eb680a638f985822889b7401b39f352f3b67d9b18b39ff9c639e2809b17a2126e17af00af9f3ac24444ef4bcdf4915108faff

Download Submit
memory/1888-2-0x0000000002030000-0x00000000021E8000-memory.dmp

Filesize
1.7MB

Download
memory/1888-4-0x00000000021F0000-0x00000000023A7000-memory.dmp

Filesize
1.7MB

Download
memory/1888-0-0x0000000002030000-0x00000000021E8000-memory.dmp

Filesize
1.7MB

Download
memory/1888-7-0x0000000002030000-0x00000000021E8000-memory.dmp

Filesize
1.7MB

Download
memory/2940-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-59-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-10-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-11-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2940-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-40-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-41-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-42-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-43-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-47-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-48-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-49-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-50-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-52-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-54-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-56-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-60-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-69-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-68-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-73-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-74-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-78-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-80-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-85-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-97-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-83-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-77-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2940-99-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download