Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 21:46

General

  • Target

    VirusShare_58b20331447d0aceee52495c551e2f68.exe

  • Size

    81KB

  • MD5

    58b20331447d0aceee52495c551e2f68

  • SHA1

    d828813f3d6219a581fefdbc02f58f2c899bb719

  • SHA256

    89a19c4c4dc3b49ac730d515b3700e4b8f132836b9b9d316e87762487ab57dd7

  • SHA512

    b2327341cc3f45c894778aca6f0467d32635460cceff4c121c9fc4e1f4d55a3a703a805f414e3f2a1e9af20e3789af3897896df8c055b21bc30003e9b6f8eb0c

  • SSDEEP

    1536:DZc66tHVhu3M6nsFc4c/caNFy7Kgv4oCd4fxfekO:D4+ciQcj07KgfOY2kO

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_58b20331447d0aceee52495c551e2f68.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_58b20331447d0aceee52495c551e2f68.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Users\Admin\AppData\Local\Temp\VirusShare_58b20331447d0aceee52495c551e2f68.exe
      C:\Users\Admin\AppData\Local\Temp\VirusShare_58b20331447d0aceee52495c551e2f68.exe
      2⤵
        PID:2396

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2032-17-0x0000000000330000-0x0000000000334000-memory.dmp

            Filesize

            16KB

          • memory/2396-5-0x0000000000400000-0x0000000000784000-memory.dmp

            Filesize

            3.5MB

          • memory/2396-30-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2396-15-0x0000000000400000-0x0000000000784000-memory.dmp

            Filesize

            3.5MB

          • memory/2396-12-0x0000000000400000-0x0000000000784000-memory.dmp

            Filesize

            3.5MB

          • memory/2396-10-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

            Filesize

            4KB

          • memory/2396-7-0x0000000000400000-0x0000000000784000-memory.dmp

            Filesize

            3.5MB

          • memory/2396-3-0x0000000000400000-0x0000000000784000-memory.dmp

            Filesize

            3.5MB

          • memory/2396-18-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2396-20-0x0000000000400000-0x0000000000784000-memory.dmp

            Filesize

            3.5MB

          • memory/2396-14-0x0000000000400000-0x0000000000784000-memory.dmp

            Filesize

            3.5MB

          • memory/2396-8-0x0000000000400000-0x0000000000784000-memory.dmp

            Filesize

            3.5MB

          • memory/2396-0-0x0000000000300000-0x0000000000400000-memory.dmp

            Filesize

            1024KB

          • memory/2396-19-0x0000000000400000-0x0000000000784000-memory.dmp

            Filesize

            3.5MB

          • memory/2396-23-0x0000000000400000-0x0000000000784000-memory.dmp

            Filesize

            3.5MB

          • memory/2396-1-0x0000000000400000-0x0000000000784000-memory.dmp

            Filesize

            3.5MB

          • memory/2396-24-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2396-25-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2396-26-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2396-27-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2396-28-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2396-29-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2396-21-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2396-31-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2396-33-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2396-35-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB