8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1

Resubmissions

17/04/2024, 12:30

240417-pprkfage31 7

17/04/2024, 12:30

17/04/2024, 12:30

17/04/2024, 12:29

17/04/2024, 12:29

16/04/2024, 13:40

Analysis

max time kernel
201s
max time network
314s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16/04/2024, 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
Size

1.9MB
MD5

30f046e1459ca02a1c2ac6fc6275092c
SHA1

8670f533c929445eb15d1e9939eaf58f47d39be3
SHA256

8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1
SHA512

dffb426dd1e7c67d6e5d31c8237c7138f78343946a0da2fb0785f5a8c6e200a56fd0d11ae4d6205fc39720141c178ecef55085e4ee39e7ff52ec6ac97a14d491
SSDEEP

49152:M6cHoIV5sg2a54Zi7O10no5YSDZnlJYmhPZh:dcL8g2pZOO10no5fDNT5PZh

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Contacts a large (767) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/3932-1-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-4-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-14-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-15-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-16-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-17-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-26-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-43-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-47-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-48-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-49-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-51-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-52-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-56-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-59-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-68-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-70-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-85-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-86-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-89-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-95-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-97-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-98-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-101-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-96-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-99-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-94-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-93-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-90-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-88-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-87-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-80-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-75-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-65-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-60-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-55-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3932-50-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3012 set thread context of 3932	3012	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3932	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
3932	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
3932	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
3932	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
3932	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
3932	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3932	3012	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72
PID 3012 wrote to memory of 3932	3012	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72
PID 3012 wrote to memory of 3932	3012	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72
PID 3012 wrote to memory of 3932	3012	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72
PID 3012 wrote to memory of 3932	3012	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72
PID 3012 wrote to memory of 3932	3012	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72
PID 3012 wrote to memory of 3932	3012	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72
PID 3012 wrote to memory of 3932	3012	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72

C:\Users\Admin\AppData\Local\Temp\8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
"C:\Users\Admin\AppData\Local\Temp\8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
  "C:\Users\Admin\AppData\Local\Temp\8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

Filesize
2.6MB

MD5
19a1ff4739901b80c88834cf7d4925eb

SHA1
75dec3747387d1a54035c9ae1ce7bc7488bec125

SHA256
1f23e720888ae52453dfe0df103aa9fd98e6e77f9ceba6c8798ba64339b26e61

SHA512
e3e0302c24bc98b07d640492a691a6d6d31a8345cf443a00d086eb91ae8a8bc26e90b3daf38288d6e2da0098097c60fb05e2e94971a4ba1c45654b357d060ac1

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
11.0MB

MD5
2df9c659fc01eea52fa0b550fe14c17d

SHA1
a5cb77f740fbc876098b19db0d9a7eb413b1a102

SHA256
3ee4b9efb1ea1bd8f6f8f62f91d50ce71c6d994d7329cdd490aab18e2c7829e5

SHA512
ee04ec4864e6c331a387f0e061cbc6f91764a258049711345d78071e54dfa435edbadbe7f6a7da3df6e104c6ffa3cb4eb3a095d69ae0cfdebb6839525aa083fd

Download Submit
memory/3012-2-0x00000000041A0000-0x0000000004362000-memory.dmp

Filesize
1.8MB

Download
memory/3012-3-0x0000000004370000-0x0000000004527000-memory.dmp

Filesize
1.7MB

Download
memory/3932-68-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-14-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-15-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-16-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-17-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-26-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-43-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-47-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-48-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-49-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-51-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-52-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-56-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-59-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-1-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-70-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-4-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-96-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-85-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-86-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-89-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-95-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-97-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-98-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-101-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-99-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-94-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-93-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-90-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-88-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-87-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-80-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-75-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-65-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-60-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-55-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3932-50-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download