6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5

max time kernel
597s
max time network
610s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
Size

1.9MB
MD5

001f6aefa850c575018eaa792a0ebbc5
SHA1

69a44211fda244815a6f7b4480dada97f7778fe0
SHA256

6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5
SHA512

24eeb6d51b6d3d2988e4eb39a0c0580013d7a3a1711d0d512a233c5a5ca1f5bb4d28b3e39e0e18990d83f592c3550e13cb905b7573c013155867b7221b9997d5
SSDEEP

24576:Z0ZIVjFxbxJMgQ5DIiJ1KxwflAbWgj8RuFwTXJsK63Ct6ij0V+uYzjy2QhL8Gbge:CC9pagQFIE1KbkYF+X70V+hy7hAI1U

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Contacts a large (845) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral3/memory/1532-4-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-3-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-13-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-38-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-39-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-40-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-41-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-45-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-51-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-52-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-55-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-61-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-59-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-60-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-65-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-68-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-74-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-78-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-79-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-84-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-89-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-95-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-103-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-100-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-93-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-97-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-96-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-92-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-94-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-90-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-85-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-87-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-83-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-80-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-77-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-75-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-73-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/1532-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

4930 discord.com
4974 discord.com

flow	ioc
4930	discord.com
4974	discord.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe

description	pid	process	target process
PID 4000 set thread context of 1532	4000	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe

pid	process
1532	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
1532	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
1532	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
1532	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
1532	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
1532	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe

description	pid	process	target process
PID 4000 wrote to memory of 1532	4000	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
PID 4000 wrote to memory of 1532	4000	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
PID 4000 wrote to memory of 1532	4000	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
PID 4000 wrote to memory of 1532	4000	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
PID 4000 wrote to memory of 1532	4000	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
PID 4000 wrote to memory of 1532	4000	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
PID 4000 wrote to memory of 1532	4000	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
PID 4000 wrote to memory of 1532	4000	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe	6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe

C:\Users\Admin\AppData\Local\Temp\6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
"C:\Users\Admin\AppData\Local\Temp\6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Users\Admin\AppData\Local\Temp\6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe
  "C:\Users\Admin\AppData\Local\Temp\6ffdead52c68fdafb9fb7e5f0b2e4fc806e56f1a3126bad04194cba602dd92c5.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3804 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:6836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

Filesize
2.7MB

MD5
4a588a9a8a45b44021e47fc04f8529de

SHA1
9da79dc4ce4697853891388fa2c6effe3d57fe50

SHA256
8c59043346979bf7be919489f68f453400e7ee05dfa334467a63d410fe9e3f5d

SHA512
8187287b39bed37d5307b5bfabacebb85072c6bf1bd485a5023b5e3bcc4282cc4bc21c543bcc95bf7a3ad5de17c90bf392dc5540432ed240657edb796223d1c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
11.2MB

MD5
7ec7adf57137d16d52a863791bee5697

SHA1
66577d356822e05f40592b54dbebee71bc48a57e

SHA256
fd748998eab92f0409fbfa2706cfce86610c3cfce562033c9f92d46dcc92dc03

SHA512
3788f786c041e6f5a118183b1e40432bb2ef1c7a2907316e928dd4dc6d30790690d10e7a5cd8e0c1afc364f5aff18305a33ea406b09080a6bfbcc1b4c6c139a2

Download Submit
memory/1532-4-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-3-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-13-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-38-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-39-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-40-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-41-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-45-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-51-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-52-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-55-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-61-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-59-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-60-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-65-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-68-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-74-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-78-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-79-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-84-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-89-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-95-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-103-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-100-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-93-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-97-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-96-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-92-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-94-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-90-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-85-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-87-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-83-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-80-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-77-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-75-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-73-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1532-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4000-1-0x00000000029C0000-0x0000000002B80000-memory.dmp

Filesize
1.8MB

Download
memory/4000-2-0x0000000002B90000-0x0000000002D47000-memory.dmp

Filesize
1.7MB

Download