965616976ed28bffd24f8316ba6bad5d6008dc511c757643f038bc6c57c37e2b | Triage

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sh.exe
Size

35KB
MD5

94d3d0b7399e8b81cab3d3faa85439fe
SHA1

5fce092dde64b5310a98692273dd94b32fae6301
SHA256

006a333cb4b268d798259fe79b8ba98eee854f02ca5fbaa4c8e3528f74f4a1a5
SHA512

9b2ac3493c7f5aca682a0ebc5000df6315c447055d1cf41a8239437644e3f7863514d40c7c7525e2dbc6484bd4a5f96747f18622fb5d47112c92b7ad2a3368dd
SSDEEP

768:WPbepWiys98ePTn1COW6Rni4FpOqVytqJ3kmkpL28:WPbeph8G15WmF6YJ38LJ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral31/memory/2292-0-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral31/memory/2292-1-0x0000000061000000-0x000000006126B000-memory.dmp	upx
behavioral31/memory/2292-2-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral31/memory/2292-3-0x0000000061000000-0x000000006126B000-memory.dmp	upx

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	sh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Cygnus Solutions	sh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Cygnus Solutions\Cygwin	sh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Cygnus Solutions\Cygwin\mounts v2	sh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Cygnus Solutions\Cygwin\Program Options	sh.exe

C:\Users\Admin\AppData\Local\Temp\sh.exe
"C:\Users\Admin\AppData\Local\Temp\sh.exe"
1⤵
- Modifies data under HKEY_USERS
PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2292-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2292-1-0x0000000061000000-0x000000006126B000-memory.dmp

Filesize
2.4MB

Download
memory/2292-2-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2292-3-0x0000000061000000-0x000000006126B000-memory.dmp

Filesize
2.4MB

Download