Overview

overview

9

Static

static

3

ae393459f9...1f.exe

windows7-x64

9

ae393459f9...1f.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2024, 01:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ae393459f9dfd0824c8a0438eb7569f6772752302139f5f22fdbfc5e589f7e1f.exe

  • Size

    384KB

  • MD5

    7aa14a025510fa26e46424325153cc67

  • SHA1

    56776af9d448675e96a4ad2c289798229095553b

  • SHA256

    ae393459f9dfd0824c8a0438eb7569f6772752302139f5f22fdbfc5e589f7e1f

  • SHA512

    5affca2864c55969cd998c59cbb2a9a3399c1e23ad5861b6f7ffd4e4a0a9babc79c6aa80c298e2bcbde4b9cee1da4b27b9c35d6f1ba1280ea90b16155165ccf9

  • SSDEEP

    6144:+A8TpOnZnLGiNeb28W0Mzk3P1LTmXV5UNvup99CdoOK:+AEpORGiAb2zZIlTsmup93

Score
9/10
persistenceupx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 6 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae393459f9dfd0824c8a0438eb7569f6772752302139f5f22fdbfc5e589f7e1f.exe
    "C:\Users\Admin\AppData\Local\Temp\ae393459f9dfd0824c8a0438eb7569f6772752302139f5f22fdbfc5e589f7e1f.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:536
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 668
      2⤵
      • Program crash
      PID:1428
    • C:\ProgramData\oF28326MdInP28326\oF28326MdInP28326.exe
      "C:\ProgramData\oF28326MdInP28326\oF28326MdInP28326.exe" "C:\Users\Admin\AppData\Local\Temp\ae393459f9dfd0824c8a0438eb7569f6772752302139f5f22fdbfc5e589f7e1f.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2080
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 668
        3⤵
        • Program crash
        PID:4280
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 536 -ip 536
    1⤵
      PID:4524
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2080 -ip 2080
      1⤵
        PID:2176
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:1064

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\oF28326MdInP28326\oF28326MdInP28326.exe
          Filesize

          384KB

          MD5

          8e4fbf74154f4a9160ce0ca4fc755e65

          SHA1

          78330bd28ae142e5f045d8aace39a606e6d21b5b

          SHA256

          cfc795ea09cdbb61f8f4790dd3a3ccdae88eb022ec28294e2239432b72759dbe

          SHA512

          59978eb7d68c90b659304294a4b3487f627121833760ad82d191194aabc274f4c28be4f4f498143305dece9ab543576d6029137c9832dec992534b852a5a8616

          Download Submit

        • memory/536-0-0x00000000006B0000-0x00000000006B2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/536-1-0x0000000000400000-0x00000000004EE000-memory.dmp

          Filesize

          952KB

          Download

        • memory/536-13-0x0000000000400000-0x00000000004EE000-memory.dmp

          Filesize

          952KB

          Download

        • memory/2080-19-0x0000000000400000-0x00000000004EE000-memory.dmp

          Filesize

          952KB

          Download

        • memory/2080-22-0x0000000000400000-0x00000000004EE000-memory.dmp

          Filesize

          952KB

          Download

        • memory/2080-28-0x0000000000400000-0x00000000004EE000-memory.dmp

          Filesize

          952KB

          Download

        • memory/2080-30-0x0000000000400000-0x00000000004EE000-memory.dmp

          Filesize

          952KB

          Download