965616976ed28bffd24f8316ba6bad5d6008dc511c757643f038bc6c57c37e2b | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

mkisofs.exe
Size

125KB
MD5

14a0f190d9872e9de65a7107e5dbc1c8
SHA1

f5df2fdf26c04759cff864c8df6db575c50d8574
SHA256

5fa3b5257f654a16c8cfe724e8f34f69c48dd632d8f103c34ad97e28dd395f52
SHA512

47f0f54f26a33e4f636716f2a632f3b63901f8fac912911c552ab86e49959026780c39f1e1ba8617a3744351fe86947b0495a1325ac5f2008dccaded81353ca0
SSDEEP

3072:i5yTsuMdqzSYK3Et99foXoidWdlrw2DmFGGrdU:iUr2YK3Et9hgoiUlmcmi

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral27/memory/2352-0-0x0000000000400000-0x0000000000480000-memory.dmp	upx
behavioral27/memory/2352-3-0x0000000061000000-0x000000006126B000-memory.dmp	upx
behavioral27/memory/2352-2-0x0000000061000000-0x000000006126B000-memory.dmp	upx
behavioral27/memory/2352-1-0x0000000000400000-0x0000000000480000-memory.dmp	upx

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Cygnus Solutions	mkisofs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Cygnus Solutions\Cygwin	mkisofs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Cygnus Solutions\Cygwin\mounts v2	mkisofs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Cygnus Solutions\Cygwin\Program Options	mkisofs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	mkisofs.exe

C:\Users\Admin\AppData\Local\Temp\mkisofs.exe
"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"
1⤵
- Modifies data under HKEY_USERS
PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-0-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2352-3-0x0000000061000000-0x000000006126B000-memory.dmp

Filesize
2.4MB

Download
memory/2352-2-0x0000000061000000-0x000000006126B000-memory.dmp

Filesize
2.4MB

Download
memory/2352-1-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download