Analysis

  • max time kernel
    144s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 21:47

General

  • Target

    VirusShare_86cb2b525e0d0bbf1351b11b4834bdd7.exe

  • Size

    358KB

  • MD5

    86cb2b525e0d0bbf1351b11b4834bdd7

  • SHA1

    22d77c58d1a7bc06adec09bca43668e5dc4241e2

  • SHA256

    1e1939ea1961ee1e05285b2ba1a7b7f4e52c41724c8d6d256c2976ecdd919431

  • SHA512

    95d4a2775f63ffac5db6a2b924a9fe4ac9ce0db7daa565b3f973db0dd03f222d7a90796cd4eb284aab3fd496d67976769c5f234914da40b2fe545a5d7c61926b

  • SSDEEP

    6144:KjbeiH734HMnpRMID1aM1+9RXZE5Yel6ZVgtdKBfZDkZeFoS3RFDoxSuLH:KuLwprD1aAKZNQMnZDHFP3Xcn

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_86cb2b525e0d0bbf1351b11b4834bdd7.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_86cb2b525e0d0bbf1351b11b4834bdd7.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        PID:2664

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.ex_

          Filesize

          93KB

          MD5

          35bbd7036c62eff49ab752a812f3f965

          SHA1

          7eed645d88ea1393003ac47a267e767f8a5b4ba1

          SHA256

          51518fbf0bcfde548d96dfb815144c6af86a90f9ffafbf9cb3d75434813e134b

          SHA512

          acbf7a3dc24442dda1188bfc533e138e59cd0169172ba58409128953dbae7d4c8953d9049fdaa8b9eb590783087374eb4353593862d952faa988d4e2e3796fa1

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe

          Filesize

          104KB

          MD5

          42ccd69a3be9618d329de0ea0fde3a81

          SHA1

          47e9897f303496eb9cd5883f9cdb283b6eee65d3

          SHA256

          14137fcc8697e967b251fd0fafbdf79af8db4c1a67f2eafe53756e3ad80a9bef

          SHA512

          33d95b20ce606441c89dbc575c8e884196a19db056ffd9d54a5e0c57f3928b0d064b6270e4abf033046606e0456156faba3f3a8e6a353e924a7461e61e46bfae

        • \Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe

          Filesize

          214KB

          MD5

          9b381b29157a3dcaa51d1d8d4fc8be43

          SHA1

          f91810ceb1c4a7ee31d31b0d2c7b947388347734

          SHA256

          89a98eb9e19a8158e9f9200e286f56043182ac9b2f5aeab00b5b6848797075da

          SHA512

          e1ea9d244ed3fbad69f5489568857b679e122752da61e57c8e4d9e01a2360ffe9651cdd6e85d8513bf33dd7461d87c93644e5768b1aca65661ccb3662461d537

        • memory/2196-11-0x00000000007F0000-0x00000000008A8000-memory.dmp

          Filesize

          736KB

        • memory/2196-9-0x00000000007F0000-0x00000000008A8000-memory.dmp

          Filesize

          736KB

        • memory/2664-41-0x0000000000400000-0x0000000000BD0000-memory.dmp

          Filesize

          7.8MB

        • memory/2664-49-0x0000000000400000-0x0000000000BD0000-memory.dmp

          Filesize

          7.8MB

        • memory/2664-29-0x0000000000400000-0x0000000000BD0000-memory.dmp

          Filesize

          7.8MB

        • memory/2664-27-0x0000000000300000-0x0000000000400000-memory.dmp

          Filesize

          1024KB

        • memory/2664-31-0x0000000000400000-0x0000000000BD0000-memory.dmp

          Filesize

          7.8MB

        • memory/2664-43-0x0000000000400000-0x0000000000BD0000-memory.dmp

          Filesize

          7.8MB

        • memory/2664-34-0x0000000000400000-0x0000000000BD0000-memory.dmp

          Filesize

          7.8MB

        • memory/2664-35-0x0000000000400000-0x0000000000BD0000-memory.dmp

          Filesize

          7.8MB

        • memory/2664-37-0x0000000000400000-0x0000000000BD0000-memory.dmp

          Filesize

          7.8MB

        • memory/2664-39-0x0000000000400000-0x0000000000BD0000-memory.dmp

          Filesize

          7.8MB

        • memory/2664-45-0x0000000000400000-0x0000000000BD0000-memory.dmp

          Filesize

          7.8MB

        • memory/2664-55-0x0000000000400000-0x0000000000BD0000-memory.dmp

          Filesize

          7.8MB

        • memory/2664-53-0x0000000000400000-0x0000000000BD0000-memory.dmp

          Filesize

          7.8MB

        • memory/2664-47-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2972-23-0x00000000001E0000-0x00000000001E2000-memory.dmp

          Filesize

          8KB

        • memory/2972-13-0x0000000000400000-0x00000000004B8000-memory.dmp

          Filesize

          736KB

        • memory/2972-24-0x0000000000290000-0x0000000000295000-memory.dmp

          Filesize

          20KB

        • memory/2972-58-0x0000000000400000-0x00000000004B8000-memory.dmp

          Filesize

          736KB