bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35

max time kernel
595s
max time network
605s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/04/2024, 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
Size

1.9MB
MD5

97e5f2c04baad060d0169b7d76cfa5de
SHA1

00d5d0699bf1ccddf28fbd9eeb6ed9aaa8bc320b
SHA256

bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35
SHA512

56fabb8ec6be3cdb582214c9519a3ae59d4b4d0e97262c646cdbc6ac54d0f0fddb692e5fbebb6589ce2e63cae4f4567812aa911765431d95d412d4a86de82e9f
SSDEEP

49152:gFnov1UndgBEDJnUJFLIzBAxmOcgSp/QDsYiX:MnovedqGoWFAxP2QHi

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Contacts a large (668) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2788-3-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-4-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-10-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-15-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-16-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-17-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-26-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-43-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-44-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-45-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-46-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-48-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-51-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-52-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-50-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-56-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-60-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-65-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-68-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-69-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-84-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-83-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-90-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-89-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-86-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-85-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-75-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-71-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-74-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-73-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-96-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-95-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-93-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2788-92-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 340 set thread context of 2788	340	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2788	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
2788	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
2788	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 2788	340	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	28
PID 340 wrote to memory of 2788	340	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	28
PID 340 wrote to memory of 2788	340	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	28
PID 340 wrote to memory of 2788	340	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	28
PID 340 wrote to memory of 2788	340	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	28
PID 340 wrote to memory of 2788	340	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	28
PID 340 wrote to memory of 2788	340	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	28
PID 340 wrote to memory of 2788	340	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	28
PID 340 wrote to memory of 2788	340	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	28

C:\Users\Admin\AppData\Local\Temp\bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
"C:\Users\Admin\AppData\Local\Temp\bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:340
- C:\Users\Admin\AppData\Local\Temp\bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
  "C:\Users\Admin\AppData\Local\Temp\bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

Filesize
2.7MB

MD5
27acfbf94480631e547b5cb508d9d4fb

SHA1
f6477330ca9aeb4a8cd19cc44e1a30fa9695b36c

SHA256
0fd156526952ba5edb62133774a19bf72f71d3c968d01fcdb517521d45a67c5e

SHA512
902ccecfa284881c1f241802b9ccd51a85da0cc48632fbd944b686d37a4fa57bc7cd01c44ef79bfe475494be780164b82ff8fa9a3e77984f6e29467843138929

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
5.5MB

MD5
7b084b4a6a5455d887d3947025a43760

SHA1
9aba222e8fb0f43c115d7df0c8b4d05155001b65

SHA256
3ed8185cdbc34b113fd47260a5bf5b014ff0f56378d08154709d4a75c6a23aaa

SHA512
3849914c272733168633a288b784fe4d143ead4665f48a4ff2a461c90854b0dcc90460bf3f69f931df59c2edb8a3c957896360a195b8aba55227d059ea6ee0fa

Download Submit
memory/340-0-0x00000000023E0000-0x0000000002598000-memory.dmp

Filesize
1.7MB

Download
memory/340-6-0x00000000023E0000-0x0000000002598000-memory.dmp

Filesize
1.7MB

Download
memory/340-5-0x00000000025A0000-0x0000000002757000-memory.dmp

Filesize
1.7MB

Download
memory/2788-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-44-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-10-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-15-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-16-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-17-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-26-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-3-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-43-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-60-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-45-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-46-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-48-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-51-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-52-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-50-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-56-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2788-4-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-83-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-68-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-69-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-84-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-65-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-90-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-89-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-86-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-85-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-75-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-71-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-74-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-73-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-96-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-95-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-93-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2788-92-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download