Resubmissions

07-05-2024 12:36

240507-pta39afh8x 10

07-05-2024 12:36

240507-ps89nafh8t 10

07-05-2024 12:36

240507-ps7qtsae72 10

07-05-2024 12:36

240507-ps65asfh7y 10

07-05-2024 12:36

240507-ps4deafh7w 8

25-04-2024 13:15

240425-qg8z7abb48 7

Analysis

  • max time kernel
    1193s
  • max time network
    1200s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07-05-2024 12:36

General

  • Target

    f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe

  • Size

    1.8MB

  • MD5

    74f0926d93b595bb0a97d12fcced1f0e

  • SHA1

    057b3c704de258d5b858afc884495405af2c7426

  • SHA256

    f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b

  • SHA512

    08f4b6a7ce8104180e538c2999115bc6cba33f3a66564db1b8369100bdbb540296207233cd25441c97f5ada1f4711c7ad4f12b18cc843ce0e9f719852444622a

  • SSDEEP

    49152:VFqIJny8yP43p0p3PvdvN71jdII5rYjsAIGi:VFqmnbc45YVN71y1AGi

Malware Config

Signatures

  • Contacts a large (676) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
    "C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4404
    • C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
      "C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:688
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 9948
        3⤵
        • Program crash
        PID:7868

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Discovery

Network Service Discovery

2
T1046

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp
    Filesize

    2.4MB

    MD5

    0ce4530144899e61e7151afe7810919f

    SHA1

    f300561ff8bbd2b426926aced1e576bd2b91d001

    SHA256

    59f1410ba288f348e46546682bc8ae589accfdb2abc49b0b59fed35ed9de32e5

    SHA512

    595a94b645837f8627b703920cec6eda3e6103ae964c91c383679f00b712343b7f8d4656db6efdaceabe8c641cf45d6461ff77cc9fafa263880bc1a0763a83e6

  • C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new
    Filesize

    17.7MB

    MD5

    4325b8919dabc5d90be471e017e3e0b9

    SHA1

    dad97fd6d02423bb15e25473457a43482e5bd310

    SHA256

    3c9a2d800b9de7eec8f06bf65d0640a1e6c53e63e35799e817497a6a5252708e

    SHA512

    46c71afe589eb721746858fe41e5e83a67e03cd43b7cdfd59b75a88f213681d47ef1a0e169008106aaa092ddb0245867af9829354b755f353c6b657fe35c737f

  • memory/688-64-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-51-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-6-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-7-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-3-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-8-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-9-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-1-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-38-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-39-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-43-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-44-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-45-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-80-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-52-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-53-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-54-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-104-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-56-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-57-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-58-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-59-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-63-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-76-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-75-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-73-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-72-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-70-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-69-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-67-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-66-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-65-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-25-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-2-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-55-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-101-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-96-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-93-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-91-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-89-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-88-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-86-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-85-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-84-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-83-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-78-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-77-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-74-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-71-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-68-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-107-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-106-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-105-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-103-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-100-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-99-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-98-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-97-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-95-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-94-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-92-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-90-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-87-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-82-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/688-79-0x0000000000400000-0x0000000000848000-memory.dmp
    Filesize

    4.3MB

  • memory/4404-4-0x0000000004B00000-0x0000000004CBC000-memory.dmp
    Filesize

    1.7MB

  • memory/4404-5-0x0000000004CC0000-0x0000000004E77000-memory.dmp
    Filesize

    1.7MB