Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 22:29

General

  • Target

    5c8fcc613c5aafd53123746456bc9726f3cd2c74e269f2f41df80aa6a87bf634.exe

  • Size

    418KB

  • MD5

    d59eb8cb36a1fd4b177de0c5a7949feb

  • SHA1

    df841a0c247c65a1bfc4b4fe6fea722b84045af2

  • SHA256

    5c8fcc613c5aafd53123746456bc9726f3cd2c74e269f2f41df80aa6a87bf634

  • SHA512

    c279252b2f3ed7ab26d03358d680ce999be792a31d15f45d0961ca3dbb9a06204cdec9a37b5a90ebf1f31c2ed533fd574d5554fc77cd9c391c059ba38a237009

  • SSDEEP

    6144:a4kCzDW+q6MEp1JfTOOOW6tEbNM6gUzKuGHxLq+nbon6Xbqzvh4V1Jpnjjjjj:aX+q9WvfaqaHI5GPnbYEAv2Nnjjjjj

Score
9/10

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 5 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c8fcc613c5aafd53123746456bc9726f3cd2c74e269f2f41df80aa6a87bf634.exe
    "C:\Users\Admin\AppData\Local\Temp\5c8fcc613c5aafd53123746456bc9726f3cd2c74e269f2f41df80aa6a87bf634.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2952
    • C:\ProgramData\fF01831DfIeL01831\fF01831DfIeL01831.exe
      "C:\ProgramData\fF01831DfIeL01831\fF01831DfIeL01831.exe" "C:\Users\Admin\AppData\Local\Temp\5c8fcc613c5aafd53123746456bc9726f3cd2c74e269f2f41df80aa6a87bf634.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\fF01831DfIeL01831\fF01831DfIeL01831

    Filesize

    192B

    MD5

    7760361d8d486c8c1233bda7ce4ca5cd

    SHA1

    7f83a223493d94799398745565f72f6d61051258

    SHA256

    44ef8bfc6e157bc20ba5f33469ef3dbd8837a6770c2c3460b6889801a8d4983b

    SHA512

    6c1320888b42c1214e1d7f9c5d4336b130fc1b856cc97db348cda6ac771f2f2ac939f09efe12f6ea577602d9cee4aae7d98d500bc7506e11c6ed4fb6858f2874

  • \ProgramData\fF01831DfIeL01831\fF01831DfIeL01831.exe

    Filesize

    418KB

    MD5

    cdf7e90a508a1c306ebbdd65f478cf9d

    SHA1

    22058a92e46dc1c7820653088c0d92178a88d9ff

    SHA256

    269cf4fd2aa75249e44bec32f938fcf2bdd4df02859547b2acae757f1ec624ca

    SHA512

    078bae1def4fd110e59700e8e1e46951d73d05507f2662ac2dbad87414c51c2d525b15a67f2e98073f95c2bac6364b82dbed0cdd18a171336e55f8950387f63e

  • memory/2720-19-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2720-25-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2720-29-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2720-38-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2952-0-0x0000000000230000-0x0000000000233000-memory.dmp

    Filesize

    12KB

  • memory/2952-3-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2952-18-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB