8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1

Resubmissions

17/04/2024, 12:30

240417-pprkfage31 7

17/04/2024, 12:30

17/04/2024, 12:30

17/04/2024, 12:29

17/04/2024, 12:29

16/04/2024, 13:40

Analysis

max time kernel
1197s
max time network
1225s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
17/04/2024, 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
Size

1.9MB
MD5

30f046e1459ca02a1c2ac6fc6275092c
SHA1

8670f533c929445eb15d1e9939eaf58f47d39be3
SHA256

8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1
SHA512

dffb426dd1e7c67d6e5d31c8237c7138f78343946a0da2fb0785f5a8c6e200a56fd0d11ae4d6205fc39720141c178ecef55085e4ee39e7ff52ec6ac97a14d491
SSDEEP

49152:M6cHoIV5sg2a54Zi7O10no5YSDZnlJYmhPZh:dcL8g2pZOO10no5fDNT5PZh

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/3448-2-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-4-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-13-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-14-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-15-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-16-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-17-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-18-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-19-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-41-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-52-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-56-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-60-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-61-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-70-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-86-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-93-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-106-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-105-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-104-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-103-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-102-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-101-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-98-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-96-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-95-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-94-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-92-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-90-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-88-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-85-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-84-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-74-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-89-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-79-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-75-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-71-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-77-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-69-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-73-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-65-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-59-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/3448-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
57	discord.com
60	discord.com
95	discord.com
239	discord.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3472 set thread context of 3448	3472	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9632	3448	WerFault.exe	72

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3448	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
3448	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
3448	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
3448	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
3448	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
3448	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 3448	3472	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72
PID 3472 wrote to memory of 3448	3472	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72
PID 3472 wrote to memory of 3448	3472	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72
PID 3472 wrote to memory of 3448	3472	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72
PID 3472 wrote to memory of 3448	3472	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72
PID 3472 wrote to memory of 3448	3472	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72
PID 3472 wrote to memory of 3448	3472	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72
PID 3472 wrote to memory of 3448	3472	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	72

C:\Users\Admin\AppData\Local\Temp\8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
"C:\Users\Admin\AppData\Local\Temp\8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Users\Admin\AppData\Local\Temp\8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
  "C:\Users\Admin\AppData\Local\Temp\8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:3448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 43408
    3⤵
    - Program crash
    PID:9632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

Filesize
2.6MB

MD5
e7634067c1219da664e2c13a622988bf

SHA1
b354b3912ec59fefecdaa660af50c679b136b6ca

SHA256
e1f51b61149b811c5029caaa39ddf54faa18fcd18bbcf432155ad324fbc0fdb7

SHA512
b61ea1448ec13e88c66e043c0f99d95a2626e631841bec0b0e2e1dd6cbbcb8f8587d414f3ad32794ccdadf7c763910ed844220684f3edc71109f47fe4353c944

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
11.0MB

MD5
b222e8f3e53120a78bed37df196d7a6d

SHA1
ee7155dcdd3488c77be0e748a02ed3063040466b

SHA256
608ac0e1abf26416dfe58a4a201a041f70f5194c291cf76b4a648eee32b50bc8

SHA512
1b454da6aaabe660ef886cff64734ec87e98c4fd2998e4f55c7874d94b3f51e2816f7ade181ecbb221fa466f1aea05df93246f2d8f5fb46bbf68fd2369ba06ed

Download Submit
memory/3448-93-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-92-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-13-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-14-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-15-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-16-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-17-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-18-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-19-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-2-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-41-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-52-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-56-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-60-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-61-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-70-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-86-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-59-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-106-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-4-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-103-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-105-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-102-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-101-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-98-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-96-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-95-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-94-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-104-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-90-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-88-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-85-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-84-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-74-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-89-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-79-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-75-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-71-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-77-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-69-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-73-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-65-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3448-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3472-1-0x0000000004340000-0x00000000044FF000-memory.dmp

Filesize
1.7MB

Download
memory/3472-3-0x0000000004500000-0x00000000046B7000-memory.dmp

Filesize
1.7MB

Download