Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-06-2024 01:40

General

  • Target

    470822d9688c7dbebfbdf0a27749a520.exe

  • Size

    131KB

  • MD5

    470822d9688c7dbebfbdf0a27749a520

  • SHA1

    c811f9a8a40b8d854dd9b4247f939d0e0f0970f8

  • SHA256

    98cfa4a514a53938fe48a4cd1466acdac9cad38340cffbe755139dd69c6f5860

  • SHA512

    094c5099d7382d8bd11ab1f20f3ff36d44ec8d14baa859fd940b9621f8f4b093350922309663e275d2b5da21f24134924a176335a24f6096bdae06ae3265c1fd

  • SSDEEP

    3072:aEboFVlGAvwsgbpvYfMTc72L10fPsout6nn:5BzsgbpvnTcyOPsoS6nn

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 33 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 23 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe
    "C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0
      2⤵
        PID:4452
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0
        2⤵
        • Deletes itself
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:4436
    • C:\Windows\system32\cmd.exe
      cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2388
      • C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
        "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1044
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0
          3⤵
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of AdjustPrivilegeToken
          PID:4492

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD

      Filesize

      132KB

      MD5

      1dbf87366c580760f9843f56c4082ea8

      SHA1

      bc77fdb76c59e583a2d7fa8587ef4ed0b94ebc39

      SHA256

      8ff85e81cc1071436214abae02d093e77c37a5bd0c0962947a812dd504f3c3d2

      SHA512

      7ce60082592c76135af02197f9334e17b759f36f25c0b017772ec4ca1bd3303f49fad68458e9e0afd25727f8ba565a45fde6166a29c9dc62486c733e6ac426c7

    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg

      Filesize

      131KB

      MD5

      016daa1ef7f61d3144acb073eab9feb4

      SHA1

      94e183afc34e31bb124845d6dcdbaa24f407ad41

      SHA256

      902ba77198b933233ef79a1cd95fb7c13c1a0520cae2a580d3830b538cec3a4d

      SHA512

      8611086f1551236d86a857939eb357792581d8c6a1307776bba0e209fc3b4c040dc5aeadf523e9711eb781575e8f96abf4a3d00c4a39935c213498d12cd490e6

    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini

      Filesize

      22B

      MD5

      a4ef93de80711124d4b7e080ccf42edb

      SHA1

      f4530f5e6d362781fa6dfa4982d25f3ad15dbf99

      SHA256

      9a09d2a2b23760cbc02ab362728b30783f943d90beebbdbd03c4e8b288492d24

      SHA512

      707c5a1a84a1cd490e3e0109c30b32724a69d27021653265bbd838065458e1eea20b470f145612f9ea5486711c47a59dcb515f9625829e63689a89af75901fa2

    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt

      Filesize

      72B

      MD5

      7172a23e7e8060e7cd167a832bec182f

      SHA1

      de84498a3da758d808860e1ac7306138f67d089a

      SHA256

      71118122eb60159b03ce3fb8a7884e86c9f916857ffe387c5277681f0d3062f7

      SHA512

      b1b81013b37a3ad46f4dbc9c6c1e28d29c38c5e1ee8c324cf95855a045e41262cc59f5e33c9e0163243a464b98e6d2a12817e2d5a96fdf704bdfff14883dcd39

    • C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

      Filesize

      131KB

      MD5

      bba40037af48d18d2743640b8f98bedc

      SHA1

      17f2f5d2beca3e9630a68c0e4d381a599f24da6a

      SHA256

      b791fc62e0a3b6eb35ed165855bbf8518b2b0329bc0ec3a65627e4dba9987fbb

      SHA512

      3e3a148652935f3972566d934e01817235a2762116c2a675a23ec85f8401ac3b800b833705f3277c4e57e2e8bc7065aefefb33fbf62bbf2344d01578fc5584b7

    • C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1B\KVEIFmain.ini

      Filesize

      1KB

      MD5

      6fc8c3a45f282558e52cfd6de5611865

      SHA1

      d5ac64c2e1c9765f9a8c7ba8ff3fadfc745db090

      SHA256

      7b3c7bca6abe91aac4feb76156237890b17d55c8020c0f99632aae9192119da4

      SHA512

      48d7fb2c46c931ea802d55149246d8716f3113f7ed11f79216b4fc5c9c8723d1ea494f6afd549b72b40b8e481ed6bfc079f7d504c9fa0556e81002996c722c84

    • C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1B\KVEIFmain.ini

      Filesize

      1KB

      MD5

      2c7262495edb225253caae800a7dd8fb

      SHA1

      450ee8c561cf873b6c1ea49b18eb83d9b4c15e06

      SHA256

      ada20fbf4d83dc428cc0526f05605c99f0e82e50381246e828dbd9b8dddad7fd

      SHA512

      cb73d3f3eee7014eb96c2d2226d0cfce83fb31af5c5f4557520320b6f39a1ae28caaf71750ba9983493cc6096af8564abb2c38a4fc4b24feee730ba7b516ae1d

    • C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1B\KVEIFmain.ini

      Filesize

      1KB

      MD5

      1ee1be9a3bb465533e2d52548122f88f

      SHA1

      7fe7cfe087a4e09e663ea79a4b0a033b89d611df

      SHA256

      907e129d252bafaf2a95dab13221ad4d60ff803334a6668cd1e2130f955513ef

      SHA512

      8e9ddbf032777844cbe26cc2cc3c522a408a1d699aeb1216f77b626deb4a813cf7baa5d81968d0138abd7df7627faf50db11dc28a3e8d62ed1096e53a64b7d1e

    • C:\Windows\SysWOW64\kernel64.dll

      Filesize

      625KB

      MD5

      eccf28d7e5ccec24119b88edd160f8f4

      SHA1

      98509587a3d37a20b56b50fd57f823a1691a034c

      SHA256

      820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6

      SHA512

      c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

    • C:\Windows\Web\606C646364636479.tmp

      Filesize

      108KB

      MD5

      f697e0c5c1d34f00d1700d6d549d4811

      SHA1

      f50a99377a7419185fc269bb4d12954ca42b8589

      SHA256

      1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16

      SHA512

      d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202

    • memory/1300-19-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/1300-21-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/1300-25-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/1300-23-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/1300-30-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/1300-17-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/1300-15-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/1300-11-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/1300-9-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/1300-27-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/1300-2-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/1300-5-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/1300-3-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/1300-32-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/1300-33-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/1300-31-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/1300-13-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/1300-7-0x00000000021E0000-0x0000000002235000-memory.dmp

      Filesize

      340KB

    • memory/4436-100-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/4436-111-0x0000000002970000-0x00000000029C5000-memory.dmp

      Filesize

      340KB

    • memory/4436-113-0x0000000002970000-0x00000000029C5000-memory.dmp

      Filesize

      340KB

    • memory/4436-131-0x0000000002970000-0x00000000029C5000-memory.dmp

      Filesize

      340KB

    • memory/4436-129-0x0000000002970000-0x00000000029C5000-memory.dmp

      Filesize

      340KB

    • memory/4436-125-0x0000000002970000-0x00000000029C5000-memory.dmp

      Filesize

      340KB

    • memory/4436-123-0x0000000002970000-0x00000000029C5000-memory.dmp

      Filesize

      340KB

    • memory/4436-121-0x0000000002970000-0x00000000029C5000-memory.dmp

      Filesize

      340KB

    • memory/4436-119-0x0000000002970000-0x00000000029C5000-memory.dmp

      Filesize

      340KB

    • memory/4436-117-0x0000000002970000-0x00000000029C5000-memory.dmp

      Filesize

      340KB

    • memory/4436-127-0x0000000002970000-0x00000000029C5000-memory.dmp

      Filesize

      340KB

    • memory/4436-115-0x0000000002970000-0x00000000029C5000-memory.dmp

      Filesize

      340KB

    • memory/4436-109-0x0000000002970000-0x00000000029C5000-memory.dmp

      Filesize

      340KB

    • memory/4436-108-0x0000000002970000-0x00000000029C5000-memory.dmp

      Filesize

      340KB

    • memory/4436-106-0x0000000002970000-0x00000000029C5000-memory.dmp

      Filesize

      340KB

    • memory/4436-104-0x0000000002970000-0x00000000029C5000-memory.dmp

      Filesize

      340KB

    • memory/4436-103-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/4436-101-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/4436-97-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/4436-245-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/4492-197-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/4492-246-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB