70666015656b481f8b32b6167bc9b0b1b947bc7619f8a5b3e699f8c9cd15c072 | Triage

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 18:31

Sharing

Report Analysis Logs

General

Target

Engines/lzzjz.exe
Size

626KB
MD5

e1f6ace332fc0376a9e2cbbd7c9d6a90
SHA1

24dc007d1483cc79c66f337db02d91e3b62f32ef
SHA256

f623a6716473d850a3364065278720f20ede19277332356a275919c632f17431
SHA512

268d168397b2129c4cccc27cbadc155d685bf57db90bcf53f0347a4d90d154a36feb0aea797fee43fc8dc8c78845ddc5d0fb7e46b77b81f22bf52c8697e5a2ba
SSDEEP

6144:LiMnrVNSoUJj65VFh0ICD32LPDZ9oLRHLichJTPRoRbcXU5HUmUGlaXZxZZBvGXo:PrvS8tR66sBtR66

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral11/memory/1612-0-0x0000000000400000-0x000000000049E000-memory.dmp	upx
behavioral11/memory/1612-1-0x0000000000400000-0x000000000049E000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

lzzjz.exe

pid process

1612 lzzjz.exe
1612 lzzjz.exe

C:\Users\Admin\AppData\Local\Temp\Engines\lzzjz.exe
"C:\Users\Admin\AppData\Local\Temp\Engines\lzzjz.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-0-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1612-1-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download