Analysis

  • max time kernel
    144s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    26-06-2024 09:10

General

  • Target

    d2fc2574c3d0c7c842ec55159924a86513913c72d66436e8d01ad9793e43cfb4.exe

  • Size

    8.6MB

  • MD5

    2ecf61eacb11ad5947aa9a27609bc771

  • SHA1

    34ca3a6b0c0d4a524f6365edc5290f359ca255f4

  • SHA256

    d2fc2574c3d0c7c842ec55159924a86513913c72d66436e8d01ad9793e43cfb4

  • SHA512

    ac92713981500dc82f9ffd22267fefd0ee2b0afad99f36be71acb4edf74c4d43851047f7d26b0cba4187a6dabd6d7de17853d9d439047fd3032fe0e33a478c8e

  • SSDEEP

    196608:wbrcnYDfiy5mO5qX8ecBVSxtAnzIWsjqxXdZ:2An4iw5nVVSxGnzbs2l

Score
7/10

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 14 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d2fc2574c3d0c7c842ec55159924a86513913c72d66436e8d01ad9793e43cfb4.exe
    "C:\Users\Admin\AppData\Local\Temp\d2fc2574c3d0c7c842ec55159924a86513913c72d66436e8d01ad9793e43cfb4.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2172

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2172-9-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/2172-35-0x0000000000400000-0x0000000001436000-memory.dmp

    Filesize

    16.2MB

  • memory/2172-34-0x0000000001470000-0x0000000001471000-memory.dmp

    Filesize

    4KB

  • memory/2172-41-0x0000000000400000-0x0000000001436000-memory.dmp

    Filesize

    16.2MB

  • memory/2172-42-0x0000000000400000-0x0000000001436000-memory.dmp

    Filesize

    16.2MB

  • memory/2172-43-0x0000000000400000-0x0000000001436000-memory.dmp

    Filesize

    16.2MB

  • memory/2172-44-0x0000000000400000-0x0000000001436000-memory.dmp

    Filesize

    16.2MB

  • memory/2172-40-0x0000000002D00000-0x0000000002D26000-memory.dmp

    Filesize

    152KB

  • memory/2172-39-0x00000000014A0000-0x00000000014C6000-memory.dmp

    Filesize

    152KB

  • memory/2172-38-0x0000000000687000-0x0000000000CE0000-memory.dmp

    Filesize

    6.3MB

  • memory/2172-32-0x0000000001470000-0x0000000001471000-memory.dmp

    Filesize

    4KB

  • memory/2172-30-0x0000000001470000-0x0000000001471000-memory.dmp

    Filesize

    4KB

  • memory/2172-45-0x0000000000400000-0x0000000001436000-memory.dmp

    Filesize

    16.2MB

  • memory/2172-29-0x0000000001460000-0x0000000001461000-memory.dmp

    Filesize

    4KB

  • memory/2172-27-0x0000000001460000-0x0000000001461000-memory.dmp

    Filesize

    4KB

  • memory/2172-24-0x0000000001450000-0x0000000001451000-memory.dmp

    Filesize

    4KB

  • memory/2172-22-0x0000000001450000-0x0000000001451000-memory.dmp

    Filesize

    4KB

  • memory/2172-19-0x0000000001440000-0x0000000001441000-memory.dmp

    Filesize

    4KB

  • memory/2172-17-0x0000000001440000-0x0000000001441000-memory.dmp

    Filesize

    4KB

  • memory/2172-14-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2172-12-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2172-7-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/2172-5-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/2172-4-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/2172-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/2172-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/2172-46-0x0000000000400000-0x0000000001436000-memory.dmp

    Filesize

    16.2MB

  • memory/2172-47-0x0000000000400000-0x0000000001436000-memory.dmp

    Filesize

    16.2MB

  • memory/2172-48-0x0000000000400000-0x0000000001436000-memory.dmp

    Filesize

    16.2MB

  • memory/2172-49-0x0000000000400000-0x0000000001436000-memory.dmp

    Filesize

    16.2MB

  • memory/2172-50-0x0000000000400000-0x0000000001436000-memory.dmp

    Filesize

    16.2MB

  • memory/2172-51-0x0000000000400000-0x0000000001436000-memory.dmp

    Filesize

    16.2MB

  • memory/2172-52-0x0000000000400000-0x0000000001436000-memory.dmp

    Filesize

    16.2MB

  • memory/2172-53-0x0000000000400000-0x0000000001436000-memory.dmp

    Filesize

    16.2MB