2854ef18b052f7b19e9ef1f006508e87f1ee3ed2592eef1aa9bb7d941852c3ca

max time kernel
144s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-04-2024 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
Size

1.9MB
MD5

456dad1f25fefa40f70c152a706316bc
SHA1

c741c8e32f1510c175c6d518401f3cf4d4f6d8da
SHA256

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412
SHA512

e51d7f476d0b92cef1d2bc012f9436aead835642381241ba6d2dd149251a3ccc09b28e0be160e1e8f62aa6da79b935a6016700e31605895042c1fe61b4ca876f
SSDEEP

49152:F/MBkUJZCcifDFu/6nEkqg1kka+dW0hWk9NQXNF+9uop3biUIgYcoP:FEBkmZofDFu/6nR6SW+woVBlR

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 40 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral3/memory/4492-3-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-22-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-23-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-24-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-25-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-26-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-30-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-31-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-45-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-48-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-49-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-59-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-68-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-69-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-71-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-77-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-74-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-80-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-83-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-90-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-100-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-109-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-111-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-110-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-108-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-107-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-106-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-103-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/4492-93-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

description	pid	process	target process
PID 2964 set thread context of 4492	2964	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

pid	process
4492	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
4492	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
4492	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
4492	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
4492	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
4492	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

description	pid	process	target process
PID 2964 wrote to memory of 4492	2964	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 2964 wrote to memory of 4492	2964	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 2964 wrote to memory of 4492	2964	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 2964 wrote to memory of 4492	2964	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 2964 wrote to memory of 4492	2964	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 2964 wrote to memory of 4492	2964	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 2964 wrote to memory of 4492	2964	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 2964 wrote to memory of 4492	2964	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
"C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2964

C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
"C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4492

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp
Filesize
2.7MB

MD5
27acfbf94480631e547b5cb508d9d4fb

SHA1
f6477330ca9aeb4a8cd19cc44e1a30fa9695b36c

SHA256
0fd156526952ba5edb62133774a19bf72f71d3c968d01fcdb517521d45a67c5e

SHA512
902ccecfa284881c1f241802b9ccd51a85da0cc48632fbd944b686d37a4fa57bc7cd01c44ef79bfe475494be780164b82ff8fa9a3e77984f6e29467843138929

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new
Filesize
8.5MB

MD5
92c668fb6042774b9b2d9620b9e65b36

SHA1
0f4b8914cf95c2f55f346e1553810b51710eb5a3

SHA256
d9b4fd6ae39f7116f14f81e5a256e7a524b2280e0805f8602d93cfcad95c8ffa

SHA512
7393ff6c6e3c67e8644b1f411998436b5a9de484d17fec64d0e1c18ae797daa52ff622f7540b431698c43a813144443c4f346b3c127395f35f04105ef1d721e3

Download Submit
memory/2964-2-0x0000000002490000-0x0000000002647000-memory.dmp

Filesize
1.7MB

Download
memory/2964-1-0x0000000000930000-0x0000000000AEA000-memory.dmp

Filesize
1.7MB

Download
memory/4492-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-110-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-22-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-3-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-24-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-25-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-26-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-30-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-31-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-45-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-48-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-49-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-23-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-68-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-69-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-71-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-77-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-74-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-80-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-83-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-90-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-100-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-109-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-111-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-59-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-108-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-107-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-106-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-103-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4492-93-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download