858ff0e6cd73fb2fc697e98f99ad5f9bd4de08a2a66f9a8b96267e169ecfc381

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ShackUp/ShackUp.exe
Size

118KB
MD5

fa6aafe1b7ac72eb50a7b6902b35766e
SHA1

348b0f81793f5b1c1850d1af5df1a41f5bab6847
SHA256

68aad7f473df5d91619e02ccc142e3821865c88d047f3297677aa78b5466697e
SHA512

c49a6ed88f108ce6e147312bf7bdc85c9f97e828f5a9e56956502f4e1ea2f3edf4c70481bc735b87efd06e81b9971c0030e1f7c4eed0873c26f334cf132d26f0
SSDEEP

3072:kYxFFZRrVmx4+gLGiIiHWN9+H1f+9O8wGJWoutR:kY9Xr/g412A8jMoS

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral23/memory/2868-0-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral23/memory/2868-1-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral23/memory/2868-6-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral23/memory/2868-12-0x0000000000400000-0x0000000000476000-memory.dmp	upx

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.shu\ShellNew\NullFile	ShackUp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShackUp.Document\shell\print\command	ShackUp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShackUp.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ShackUp\\ShackUp.exe /pt \"%1\" \"%2\" \"%3\" \"%4\""	ShackUp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShackUp.Document\DefaultIcon	ShackUp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShackUp.Document\shell\open	ShackUp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShackUp.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ShackUp\\ShackUp.exe /p \"%1\""	ShackUp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShackUp.Document\shell\printto\command	ShackUp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.shu\ShellNew	ShackUp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShackUp.Document	ShackUp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShackUp.Document\ = "ShackUp Document"	ShackUp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShackUp.Document\shell\printto	ShackUp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.shu\ = "ShackUp.Document"	ShackUp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShackUp.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ShackUp\\ShackUp.exe,1"	ShackUp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShackUp.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ShackUp\\ShackUp.exe \"%1\""	ShackUp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShackUp.Document\shell\print	ShackUp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.shu	ShackUp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShackUp.Document\shell\open\command	ShackUp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShackUp.Document\shell	ShackUp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	ShackUp.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2868	ShackUp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2868	ShackUp.exe
2868	ShackUp.exe

C:\Users\Admin\AppData\Local\Temp\ShackUp\ShackUp.exe
"C:\Users\Admin\AppData\Local\Temp\ShackUp\ShackUp.exe"
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2868-0-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2868-1-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2868-6-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2868-12-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download