92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b

Resubmissions

09-04-2024 13:37

240409-qwz1tsbf5w 7

09-04-2024 13:37

09-04-2024 13:37

09-04-2024 13:37

05-03-2024 02:32

Analysis

max time kernel
254s
max time network
600s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
09-04-2024 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
Size

1.8MB
MD5

f41c9e6ca239395e71bcf027987282dc
SHA1

560a973e308f20e0dbe64a38eaeaa22285ced049
SHA256

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b
SHA512

cbf99c0e43b3a314ee6681f8655a269c0d51e4d40c10ea9c8571be30c5d69c0287c57be5b13e4fa7aecad7095efb4a741f1839dc9089251f41fa96f35011764a
SSDEEP

24576:h7OEqlRKCYqoxOMto8enhtiQkbx6zWXXfKfzZn00Eze2aP4sjagjotkEz4RaZMjM:h7B50L7fiQ26zEXfId0vFaQgMh4pj

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Contacts a large (853) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral4/memory/2004-3-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-4-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-14-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-15-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-16-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-26-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-35-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-36-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-49-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-54-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-55-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-59-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-56-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-61-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-60-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-69-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-70-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-65-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-73-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-75-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-77-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-80-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-78-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-79-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-84-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-85-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-87-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-95-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-94-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-98-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-99-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-96-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-97-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/2004-108-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Suspicious use of SetThreadContext 1 IoCs

Processes:

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

description	pid	process	target process
PID 1932 set thread context of 2004	1932	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

pid	process
2004	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
2004	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
2004	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
2004	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
2004	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
2004	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

description	pid	process	target process
PID 1932 wrote to memory of 2004	1932	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 1932 wrote to memory of 2004	1932	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 1932 wrote to memory of 2004	1932	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 1932 wrote to memory of 2004	1932	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 1932 wrote to memory of 2004	1932	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 1932 wrote to memory of 2004	1932	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 1932 wrote to memory of 2004	1932	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
PID 1932 wrote to memory of 2004	1932	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe	92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe

C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
"C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
  "C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus

Filesize
2.6MB

MD5
dafad6822434f0f3c41dfe9faf8892f2

SHA1
8ec4149fe13ca172ed1e3058b107bd89bb1f3015

SHA256
56d314bf70a9bb7ea42a57154fa76edc7ed1f67f222b6808d40c740076e96e94

SHA512
6a961abb9747dadc37d69c1aeaa6af036d993a27326d4c0135eed6ac85490ce69a6543c23d0d3befad352af0b97a9bb9267736c504d55f1d2ef4e2378a0a115d

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
7.1MB

MD5
5b227107e783d0afc5ba27a8c2325f3b

SHA1
2c28eb03ac9f2c9154277b4cafb4bd40f04ba8a9

SHA256
6ee58b071fae144e8422f3998e8f8f722a3d188fedacadb2966a706edb3f80a0

SHA512
110b735703e940ade424bdd95bd52df8a3954b8738a43a6c7773e89b5cd3c519ac2c1c166c2b6df5e218e3dcfaa8d7a6e4005741710eff4397bd1b214b44717a

Download Submit
memory/1932-2-0x00000000041B0000-0x0000000004367000-memory.dmp

Filesize
1.7MB

Download
memory/1932-1-0x0000000003FE0000-0x00000000041A1000-memory.dmp

Filesize
1.8MB

Download
memory/2004-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-94-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-14-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-15-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-16-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-26-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-4-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-35-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-36-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-49-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-3-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-55-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-59-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-56-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-61-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-60-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-54-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-77-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-70-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-65-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-73-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-75-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-69-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-80-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-78-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-79-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-84-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-85-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-87-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-95-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-98-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-99-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-96-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-97-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2004-108-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download