079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04

Resubmissions

07-05-2024 08:45

240507-kn5nfsha6t 10

07-05-2024 08:45

07-05-2024 08:44

07-05-2024 08:44

07-05-2024 08:44

25-04-2024 13:01

Analysis

max time kernel
98s
max time network
299s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe
Size

1.8MB
MD5

05e0bbeb4452eb1e90ba6e2c730519df
SHA1

a231b7fc6fd2ac37f29d0c20531dba861fc3afa9
SHA256

079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04
SHA512

3ba2dd278cf8e6b91c8b44839e37bb47f64262de2d42341711acfa0e790491690c965cac9d39de9c76105004dfa0dee34f391ff0d01097f8bf262d94300e78f1
SSDEEP

49152:/gceKimpc/OM9yeF/WRG+jFvmpQtySk5kf:/gpKBp6O8yeFIG+jVaH

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2120-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-10-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-11-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-24-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-26-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-27-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-30-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-46-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-47-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-50-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-54-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-55-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-56-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-59-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-65-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-77-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-83-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-89-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-94-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-99-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-103-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-100-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-98-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-97-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-95-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-93-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-86-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-80-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-74-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-73-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-71-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-69-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-68-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2120-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe

description	pid	process	target process
PID 2244 set thread context of 2120	2244	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe

pid	process
2120	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe
2120	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe
2120	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe

description	pid	process	target process
PID 2244 wrote to memory of 2120	2244	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe
PID 2244 wrote to memory of 2120	2244	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe
PID 2244 wrote to memory of 2120	2244	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe
PID 2244 wrote to memory of 2120	2244	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe
PID 2244 wrote to memory of 2120	2244	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe
PID 2244 wrote to memory of 2120	2244	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe
PID 2244 wrote to memory of 2120	2244	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe
PID 2244 wrote to memory of 2120	2244	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe
PID 2244 wrote to memory of 2120	2244	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe	079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe

C:\Users\Admin\AppData\Local\Temp\079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe
"C:\Users\Admin\AppData\Local\Temp\079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe
  "C:\Users\Admin\AppData\Local\Temp\079d3ed502ea4bddba6eddae4b7b227dce3315db40ca10d26741abe23d81fd04.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

Filesize
2.5MB

MD5
84e49117ff2bdf43e685eb0c61e226aa

SHA1
f55d1a80c7c8c9435b787d5ea4764f3cb17a0771

SHA256
da63ec7df89f3f47fd25e7736764bdb67ba21093e1dc00e0059620b12caee426

SHA512
292011df58b6def6c267dfa8112848ce13b7a48820443bb87a82eb93cdcc957f0871086f713ce3697d452124c7b1de686b542139b5210a9f6ed193c6b730e822

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
5.2MB

MD5
229358de7e5dc5782fb2fce36753451d

SHA1
0618e3559127184b335443b04ecbf2f6b5461391

SHA256
728e909043a8abdce4391055642dafd7691e4e8bd901a94b81de683f871e4524

SHA512
d3908cd63c9d68f180bd6991d81518529ca74fae038aa6348b60906ceee1e4324adf15cae2688e3f87ad5ac1207afe3613dd45719c9d4ae5c921781af28ee231

Download Submit
memory/2120-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-74-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2120-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-10-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-11-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-24-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-26-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-27-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-30-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-46-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-47-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-50-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-54-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-55-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-56-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-59-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-68-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-69-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-89-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-77-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-83-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-94-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-99-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-103-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-100-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-98-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-97-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-95-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-93-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-86-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-80-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-65-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-73-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2120-71-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2244-4-0x0000000002020000-0x00000000021D7000-memory.dmp

Filesize
1.7MB

Download
memory/2244-0-0x0000000001E40000-0x0000000001FF8000-memory.dmp

Filesize
1.7MB

Download
memory/2244-2-0x0000000001E40000-0x0000000001FF8000-memory.dmp

Filesize
1.7MB

Download