Overview

overview

9

Static

static

3

6ffdead52c...c5.exe

windows7-x64

7

6ffdead52c...c5.exe

windows10-1703-x64

8

6ffdead52c...c5.exe

windows10-2004-x64

9

6ffdead52c...c5.exe

windows11-21h2-x64

8

Resubmissions

11-04-2024 07:29

240411-jbfccsef62 10

11-04-2024 07:28

240411-jaw9gshg4y 9

11-04-2024 07:28

240411-jawmysef47 10

11-04-2024 07:28

240411-jawb7aef46 8

11-04-2024 07:28

240411-jav2esef45 7

07-04-2024 09:04

240407-k11v2ahh64 7

07-04-2024 09:04

240407-k1s57ahe5z 10

07-04-2024 09:03

240407-k1d19she41 10

07-04-2024 09:03

240407-kz78qahe4v 8

18-12-2023 04:55

231218-fj6bzaadg5 10

Analysis

  • max time kernel
    1654s
  • max time network
    1805s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-04-2024 07:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe

  • Size

    1.9MB

  • MD5

    001f6aefa850c575018eaa792a0ebbc5

  • SHA1

    69a44211fda244815a6f7b4480dada97f7778fe0

  • SHA256

    6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5

  • SHA512

    24eeb6d51b6d3d2988e4eb39a0c0580013d7a3a1711d0d512a233c5a5ca1f5bb4d28b3e39e0e18990d83f592c3550e13cb905b7573c013155867b7221b9997d5

  • SSDEEP

    24576:Z0ZIVjFxbxJMgQ5DIiJ1KxwflAbWgj8RuFwTXJsK63Ct6ij0V+uYzjy2QhL8Gbge:CC9pagQFIE1KbkYF+X70V+hy7hAI1U

Score
9/10
discoverymotwpersistencephishingupx

Malware Config

Signatures

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • UPX packed file 55 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Mark of the Web detected: This indicates that the page was originally saved or cloned. 2 IoCs
    phishingmotw
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
    "C:\Users\Admin\AppData\Local\Temp\6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Users\Admin\AppData\Local\Temp\6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
      "C:\Users\Admin\AppData\Local\Temp\6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:3448
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4848 --field-trial-handle=2260,i,9938964625802268469,1928462186077019554,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1224
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4356 --field-trial-handle=2260,i,9938964625802268469,1928462186077019554,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:6432

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Discovery

      Network Service Discovery

      1
      T1046

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Resource Development

      Reconnaissance

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp
        Filesize

        2.7MB

        MD5

        4a588a9a8a45b44021e47fc04f8529de

        SHA1

        9da79dc4ce4697853891388fa2c6effe3d57fe50

        SHA256

        8c59043346979bf7be919489f68f453400e7ee05dfa334467a63d410fe9e3f5d

        SHA512

        8187287b39bed37d5307b5bfabacebb85072c6bf1bd485a5023b5e3bcc4282cc4bc21c543bcc95bf7a3ad5de17c90bf392dc5540432ed240657edb796223d1c2

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new
        Filesize

        6.0MB

        MD5

        711c6413525f17b6eb4deb6a70c13073

        SHA1

        f183bbbfad86290b26d1e4a39963802a29f4ad37

        SHA256

        07e586ef92208f3faa6a508dd6df1119b19d124ea6791b213e7a4755bdabad28

        SHA512

        f5dde5b4b5b9d74c9a672581ce209c3ad8828830394460355fb1a80063f0d5ac96196b187b373c4153e5634320f59988b5aa7c25b549fb3ed5ca330e7f284f48

        Download Submit
      • memory/1108-2-0x0000000002BC0000-0x0000000002D77000-memory.dmp
        Filesize

        1.7MB

        Download
      • memory/1108-1-0x00000000029F0000-0x0000000002BB6000-memory.dmp
        Filesize

        1.8MB

        Download
      • memory/3448-3-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-4-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-5-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-6-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-7-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-8-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-13-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-14-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-15-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-24-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-35-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-42-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-46-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-49-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-50-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-54-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-55-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-56-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-60-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-61-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-62-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-63-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-64-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-65-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-68-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-67-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-70-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-77-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-81-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-98-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-97-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-94-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-87-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-86-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-89-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-88-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-79-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-84-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-82-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-75-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-80-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-74-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-78-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-73-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-72-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-66-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-96-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-104-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-103-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-102-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-101-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-106-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-95-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-93-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download
      • memory/3448-92-0x0000000000400000-0x0000000000848000-memory.dmp
        Filesize

        4.3MB

        Download