2854ef18b052f7b19e9ef1f006508e87f1ee3ed2592eef1aa9bb7d941852c3ca

max time kernel
144s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-04-2024 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
Size

1.9MB
MD5

456dad1f25fefa40f70c152a706316bc
SHA1

c741c8e32f1510c175c6d518401f3cf4d4f6d8da
SHA256

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412
SHA512

e51d7f476d0b92cef1d2bc012f9436aead835642381241ba6d2dd149251a3ccc09b28e0be160e1e8f62aa6da79b935a6016700e31605895042c1fe61b4ca876f
SSDEEP

49152:F/MBkUJZCcifDFu/6nEkqg1kka+dW0hWk9NQXNF+9uop3biUIgYcoP:FEBkmZofDFu/6nR6SW+woVBlR

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2652-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-10-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-11-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-16-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-17-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-18-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-19-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-28-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-29-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-30-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-37-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-45-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-46-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-50-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-51-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-61-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2652-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

description	pid	process	target process
PID 2176 set thread context of 2652	2176	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

pid	process
2652	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
2652	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
2652	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

description	pid	process	target process
PID 2176 wrote to memory of 2652	2176	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 2176 wrote to memory of 2652	2176	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 2176 wrote to memory of 2652	2176	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 2176 wrote to memory of 2652	2176	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 2176 wrote to memory of 2652	2176	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 2176 wrote to memory of 2652	2176	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 2176 wrote to memory of 2652	2176	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 2176 wrote to memory of 2652	2176	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 2176 wrote to memory of 2652	2176	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
"C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2176

C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
"C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2652

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp
Filesize
2.7MB

MD5
bd169440e5172999c9752977e42dd84c

SHA1
74e4b0c0a08e16fb76ef1d0d64b0cfdd8d8ce1a4

SHA256
1b9122b9faabbeccac50893248c8bb728ebf224a011a7f4db5d6f06e59e9e995

SHA512
8d72f5a5c0fb829db8a75d003a90f668918cc4bc13f4c086c4dec3efa30af0583ccf82af06d3bfb0f16086dcc702c81947e16ea8cda78753c747cb8dcee0cbfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new
Filesize
5.7MB

MD5
9c48a6fe68384d96ce4005d285df69d6

SHA1
5a877a46abccf39ddba3586b24bf6d98b96c49b4

SHA256
37b684444d2e477e69218309f9d861ade7843f74f360ebe4705c056b53c71220

SHA512
68bf318744e8853fd8c965c9f3111c6742cb8d443cdf36f8ee19faf503d5409783a3e2b0b3f0b8027342b0b45a9cd8130b66d66bb8c4dd0aaa07d9371704087c

Download Submit
memory/2176-0-0x00000000009F0000-0x0000000000BA8000-memory.dmp

Filesize
1.7MB

Download
memory/2176-1-0x00000000009F0000-0x0000000000BA8000-memory.dmp

Filesize
1.7MB

Download
memory/2176-2-0x00000000022F0000-0x00000000024A7000-memory.dmp

Filesize
1.7MB

Download
memory/2652-18-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-29-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-10-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-11-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-16-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-17-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-19-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-28-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-30-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-37-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2652-45-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-46-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-50-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-51-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-61-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download