965616976ed28bffd24f8316ba6bad5d6008dc511c757643f038bc6c57c37e2b | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 21:44

Sharing

Report Analysis Logs

General

Target

cdrecord.exe
Size

134KB
MD5

597e917a40119d09cc5c68c5a9fc920a
SHA1

c9aa9498ccf4ff9b52c28f367a7f927ba7df9f88
SHA256

8da95200d274b49e7fa51da24d3896db9f899e1e02f4accc2b99837a033632d8
SHA512

3204d03d0a17bc9b6d49fcd1fe30ded59fe5cc0bf4e16cacf6cee1847a6fd2f1cfd299cffeaa2b807ba14c9677ced0581dcfa4fce21cf98ba5966a42c08373f0
SSDEEP

3072:NaSsjz4X5TsG/OGJtNZPjcbZKPQk0aum8iJ2/GNbCYJBExyWcUi+:Ntsjz4JmGTAEoBaum8iUGN3jLJ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral15/memory/2460-0-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral15/memory/2460-1-0x0000000061000000-0x000000006126B000-memory.dmp	upx
behavioral15/memory/2460-2-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral15/memory/2460-3-0x0000000061000000-0x000000006126B000-memory.dmp	upx

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	cdrecord.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Cygnus Solutions	cdrecord.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Cygnus Solutions\Cygwin	cdrecord.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Cygnus Solutions\Cygwin\mounts v2	cdrecord.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Cygnus Solutions\Cygwin\Program Options	cdrecord.exe

C:\Users\Admin\AppData\Local\Temp\cdrecord.exe
"C:\Users\Admin\AppData\Local\Temp\cdrecord.exe"
1⤵
- Modifies data under HKEY_USERS
PID:2460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2460-0-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2460-1-0x0000000061000000-0x000000006126B000-memory.dmp

Filesize
2.4MB

Download
memory/2460-2-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2460-3-0x0000000061000000-0x000000006126B000-memory.dmp

Filesize
2.4MB

Download