8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1

Resubmissions

17/04/2024, 12:30

240417-pprkfage31 7

17/04/2024, 12:30

17/04/2024, 12:30

17/04/2024, 12:29

17/04/2024, 12:29

16/04/2024, 13:40

Analysis

max time kernel
1192s
max time network
1199s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
17/04/2024, 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
Size

1.9MB
MD5

30f046e1459ca02a1c2ac6fc6275092c
SHA1

8670f533c929445eb15d1e9939eaf58f47d39be3
SHA256

8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1
SHA512

dffb426dd1e7c67d6e5d31c8237c7138f78343946a0da2fb0785f5a8c6e200a56fd0d11ae4d6205fc39720141c178ecef55085e4ee39e7ff52ec6ac97a14d491
SSDEEP

49152:M6cHoIV5sg2a54Zi7O10no5YSDZnlJYmhPZh:dcL8g2pZOO10no5fDNT5PZh

Score

10^/10

discovery persistence upx

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
sps-technoscreen.com
Port:
21
Username:
[email protected]
Password:
thclnwph#

Extracted

Credentials

Protocol: ftp
Host:
www.sps-technoscreen.com
Port:
21
Username:
franck-ortega
Password:
thclnwph#

Signatures

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/880-1-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-2-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-14-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-15-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-16-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-17-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-18-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-27-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-37-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-38-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-43-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-44-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-59-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-65-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-68-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-73-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-74-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-78-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-84-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-77-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-80-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-86-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-100-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-97-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-110-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-101-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-111-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-107-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-104-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-103-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-93-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-92-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-98-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-96-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-95-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-94-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-87-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-90-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-89-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/880-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	88.198.207.48

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4924 set thread context of 880	4924	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	74

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4872	880	WerFault.exe	74

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
880	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
880	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
880	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
880	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
880	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
880	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 880	4924	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	74
PID 4924 wrote to memory of 880	4924	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	74
PID 4924 wrote to memory of 880	4924	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	74
PID 4924 wrote to memory of 880	4924	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	74
PID 4924 wrote to memory of 880	4924	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	74
PID 4924 wrote to memory of 880	4924	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	74
PID 4924 wrote to memory of 880	4924	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	74
PID 4924 wrote to memory of 880	4924	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	74

C:\Users\Admin\AppData\Local\Temp\8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
"C:\Users\Admin\AppData\Local\Temp\8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
  "C:\Users\Admin\AppData\Local\Temp\8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 37884
    3⤵
    - Program crash
    PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

Filesize
2.6MB

MD5
e7634067c1219da664e2c13a622988bf

SHA1
b354b3912ec59fefecdaa660af50c679b136b6ca

SHA256
e1f51b61149b811c5029caaa39ddf54faa18fcd18bbcf432155ad324fbc0fdb7

SHA512
b61ea1448ec13e88c66e043c0f99d95a2626e631841bec0b0e2e1dd6cbbcb8f8587d414f3ad32794ccdadf7c763910ed844220684f3edc71109f47fe4353c944

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
9.2MB

MD5
b40f547c1b5b40c562b513c0b356a3d4

SHA1
8add1d02a9a517238dc6ed48a902544ecabda68f

SHA256
2dc9e870a3b5633b8feaf552e40c2c103e87ede4666ed82947c8a5e011d84d99

SHA512
1a08769c020bb19f0985e7e5e0a145b883881e612a190b41cb6cae161f14ed0f15bc42a0e0db6dd496eb5bba34aa3dd2a85630622f434058cfbd3eb8ea110494

Download Submit
memory/880-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-80-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-14-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-15-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-16-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-17-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-18-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-2-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-27-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-89-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-37-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-38-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-43-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-44-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-59-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-65-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-1-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-73-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-68-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-74-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-78-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-84-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-77-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-86-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-100-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-97-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-110-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-101-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-111-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-107-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-104-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-103-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-93-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-92-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-98-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-96-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-95-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-94-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-87-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/880-90-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4924-3-0x0000000004170000-0x000000000432C000-memory.dmp

Filesize
1.7MB

Download
memory/4924-4-0x0000000004330000-0x00000000044E7000-memory.dmp

Filesize
1.7MB

Download