92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b

Resubmissions

09-04-2024 13:37

240409-qwz1tsbf5w 7

09-04-2024 13:37

09-04-2024 13:37

09-04-2024 13:37

05-03-2024 02:32

Analysis

max time kernel
595s
max time network
608s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09-04-2024 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
Size

1.8MB
MD5

f41c9e6ca239395e71bcf027987282dc
SHA1

560a973e308f20e0dbe64a38eaeaa22285ced049
SHA256

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b
SHA512

cbf99c0e43b3a314ee6681f8655a269c0d51e4d40c10ea9c8571be30c5d69c0287c57be5b13e4fa7aecad7095efb4a741f1839dc9089251f41fa96f35011764a
SSDEEP

24576:h7OEqlRKCYqoxOMto8enhtiQkbx6zWXXfKfzZn00Eze2aP4sjagjotkEz4RaZMjM:h7B50L7fiQ26zEXfId0vFaQgMh4pj

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Contacts a large (770) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1000-3-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-14-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-15-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-16-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-17-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-18-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-19-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-20-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-31-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-48-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-49-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-54-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-55-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-65-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-70-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-74-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-79-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-80-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-83-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-92-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-95-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-100-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-104-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-105-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-102-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-101-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-99-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-96-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-93-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-94-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-90-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-84-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-87-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-78-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-73-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-71-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-69-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/1000-60-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Suspicious use of SetThreadContext 1 IoCs

Processes:

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

description	pid	process	target process
PID 5072 set thread context of 1000	5072	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

6164 1000 WerFault.exe 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

pid	pid_target	process	target process
6164	1000	WerFault.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

pid	process
1000	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
1000	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
1000	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
1000	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
1000	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
1000	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

description	pid	process	target process
PID 5072 wrote to memory of 1000	5072	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 5072 wrote to memory of 1000	5072	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 5072 wrote to memory of 1000	5072	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 5072 wrote to memory of 1000	5072	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 5072 wrote to memory of 1000	5072	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 5072 wrote to memory of 1000	5072	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 5072 wrote to memory of 1000	5072	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 5072 wrote to memory of 1000	5072	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
"C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
  "C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:1000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 37480
    3⤵
    - Program crash
    PID:6164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

Filesize
2.6MB

MD5
f6830fcf6326c3f2f06bc27cd853799b

SHA1
1d7e3413e3821bbbbdb4c71246b5d58c26da8efb

SHA256
52c4b2d620a115c96d3e3b390f7d0a19695cff31e5f522c6a1bcff554c0a016a

SHA512
6ad3ce744073ba77902a5d4a4a762d0e335d99a7e602e24a5c7941c8f421fe92ba13a0cc7e81300dcec0179cc919d4fc72e993823ce4e066d2d96a6496822c1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
20.4MB

MD5
165cea6818e2277181852ff5f4dc361d

SHA1
8a075a86099f5513a35610303dd90b14d032d85a

SHA256
5d18f4541c513db03f99b175fcf2ddeb0882e1344ac78607e3822cc45895e2de

SHA512
255c2e660b6f1a41e709a7793aaf117d5ef6e7f1811f5c18e3e783378e2d6bd9b1a02eaad4be1f2ef7d6d183e3684a1df685cbddc8e7d8d90955124d2c1dc106

Download Submit
memory/1000-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-71-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-14-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-15-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-16-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-17-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-18-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-19-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-20-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-3-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-31-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-60-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-48-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-49-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-54-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-55-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-65-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-95-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-79-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-80-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-83-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-92-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-74-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-100-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-104-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-105-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-102-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-101-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-99-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-96-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-93-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-94-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-90-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-84-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-87-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-78-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-73-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-70-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-69-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1000-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/5072-1-0x0000000003DD0000-0x0000000003F8F000-memory.dmp

Filesize
1.7MB

Download
memory/5072-2-0x0000000003F90000-0x0000000004147000-memory.dmp

Filesize
1.7MB

Download