Resubmissions
07-05-2024 12:36
240507-pta39afh8x 1007-05-2024 12:36
240507-ps89nafh8t 1007-05-2024 12:36
240507-ps7qtsae72 1007-05-2024 12:36
240507-ps65asfh7y 1007-05-2024 12:36
240507-ps4deafh7w 825-04-2024 13:15
240425-qg8z7abb48 7Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
07-05-2024 12:36
General
-
Target
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
-
Size
1.8MB
-
MD5
74f0926d93b595bb0a97d12fcced1f0e
-
SHA1
057b3c704de258d5b858afc884495405af2c7426
-
SHA256
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b
-
SHA512
08f4b6a7ce8104180e538c2999115bc6cba33f3a66564db1b8369100bdbb540296207233cd25441c97f5ada1f4711c7ad4f12b18cc843ce0e9f719852444622a
-
SSDEEP
49152:VFqIJny8yP43p0p3PvdvN71jdII5rYjsAIGi:VFqmnbc45YVN71y1AGi
Score
7/10
Malware Config
Signatures
-
UPX packed file 59 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe"C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe"C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmpFilesize
2.4MB
MD50ce4530144899e61e7151afe7810919f
SHA1f300561ff8bbd2b426926aced1e576bd2b91d001
SHA25659f1410ba288f348e46546682bc8ae589accfdb2abc49b0b59fed35ed9de32e5
SHA512595a94b645837f8627b703920cec6eda3e6103ae964c91c383679f00b712343b7f8d4656db6efdaceabe8c641cf45d6461ff77cc9fafa263880bc1a0763a83e6
-
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.newFilesize
5.4MB
MD52a91b509a99b1a2f982910efad293c0e
SHA1d344e592db98c54af693ca0a17e8d61fafa4c7bd
SHA256817dc9896ca037b09dbe25b25a9512ef4da8eb84ecb6211da8cfdac9c91b9c6d
SHA512b72ee359f6217e0d0dcdebcab92d8169300fdea6aca1a93ff583837d5215964084e1a1f2e1defd35d8e2aabee579481456020d10341cdf3266ad0a9d5b26a454
-
memory/1984-0-0x0000000004580000-0x0000000004738000-memory.dmpFilesize
1.7MB
-
memory/1984-4-0x0000000004580000-0x0000000004738000-memory.dmpFilesize
1.7MB
-
memory/1984-7-0x0000000004740000-0x00000000048F7000-memory.dmpFilesize
1.7MB
-
memory/1984-31-0x0000000004740000-0x00000000048F7000-memory.dmpFilesize
1.7MB
-
memory/2636-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2636-3-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-9-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-8-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-6-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-10-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-5-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-11-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-29-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-32-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-43-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-47-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-48-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-68-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-69-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-96-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-94-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-90-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-89-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-88-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-86-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-84-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-82-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-80-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-78-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-77-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-76-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-74-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-73-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-72-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-70-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-67-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-66-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-65-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-64-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-62-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-61-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-60-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-58-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-57-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-54-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-53-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-52-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-51-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-50-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-49-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-98-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-95-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-92-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-87-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-85-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-83-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-81-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-79-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-75-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-71-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-63-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-59-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-56-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2636-55-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB