Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    26-06-2024 10:26

General

  • Target

    48dd32091d8fe37fdf7708b6d3ffafc583d04578a6baed7b8cf6e31b78270833.exe

  • Size

    10.2MB

  • MD5

    e7a395f3d6e3d5b38e927864d7783495

  • SHA1

    b40cc6dae9760986c4824b801e8532a1bbbeb6aa

  • SHA256

    48dd32091d8fe37fdf7708b6d3ffafc583d04578a6baed7b8cf6e31b78270833

  • SHA512

    b891c91e8a6b49beaf952d59c63c49bac178622a857a747336fdf0a83c5ebca263466246831d2ab83302d5d1758684647546d4f1d20738eaaf22ff5714c19c11

  • SSDEEP

    196608:fKlHKom3MAM3hYdjAGm82ZKElZdpecJJqUi5loF9xtMjX2WO2urVu9HlNcE6H:ClqomlMxkcGmNcEZpeO4Ui5loF9/OPxy

Score
7/10

Malware Config

Signatures

  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 26 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48dd32091d8fe37fdf7708b6d3ffafc583d04578a6baed7b8cf6e31b78270833.exe
    "C:\Users\Admin\AppData\Local\Temp\48dd32091d8fe37fdf7708b6d3ffafc583d04578a6baed7b8cf6e31b78270833.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1244

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    53e3d959ac3d87f0fb8f7c48612dfff4

    SHA1

    54ae1ee3c6e1f654c073ab1f5eb5e367eea276c4

    SHA256

    5bad1e874f54e365e08359f6ce39c8fece9d6f3bf0060f705294e31f68a19198

    SHA512

    0f74ef83cc40c5bf703d1b93420364aa8db2f29816521f655d37f628b744f7d1a16ee184ba5b32c933deefd76d324693355a6d188eaeef774ee4b363aa1ecd11

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    5f37503c57e22041a75e4fbc8356bf1e

    SHA1

    33650d5490ac3a8dc59ebedf29a35e811713522a

    SHA256

    c11285546096b898bdedec2d9d5748964b90ae1824eb154fcf3e90adbb42bc2e

    SHA512

    174ff96a24db30d1ea7b5ffe082967ecaebc13ba35fcb958de9df824c03e7e1271988375debc5abc101a68355a4bae6f8f97bbb75a1459aaadd7eb44b11ee3b6

  • C:\Users\Admin\AppData\Local\Temp\Tar3384.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/1244-55-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1244-34-0x0000000000350000-0x0000000000351000-memory.dmp

    Filesize

    4KB

  • memory/1244-0-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/1244-36-0x0000000000B2C000-0x000000000118B000-memory.dmp

    Filesize

    6.4MB

  • memory/1244-51-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1244-32-0x0000000000350000-0x0000000000351000-memory.dmp

    Filesize

    4KB

  • memory/1244-30-0x0000000000350000-0x0000000000351000-memory.dmp

    Filesize

    4KB

  • memory/1244-29-0x0000000000340000-0x0000000000341000-memory.dmp

    Filesize

    4KB

  • memory/1244-27-0x0000000000340000-0x0000000000341000-memory.dmp

    Filesize

    4KB

  • memory/1244-24-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/1244-22-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/1244-19-0x0000000000320000-0x0000000000321000-memory.dmp

    Filesize

    4KB

  • memory/1244-17-0x0000000000320000-0x0000000000321000-memory.dmp

    Filesize

    4KB

  • memory/1244-14-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/1244-12-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/1244-9-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/1244-7-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/1244-5-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/1244-67-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1244-65-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1244-82-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-63-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1244-83-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-61-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1244-59-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1244-84-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-57-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1244-4-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/1244-146-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-2-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/1244-49-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1244-47-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1244-45-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1244-43-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1244-41-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1244-40-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1244-39-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1244-85-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-86-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-87-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-88-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-89-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-90-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-91-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-92-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-93-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-94-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-95-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-96-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-97-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-98-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-99-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-100-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-142-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-143-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-144-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-145-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-53-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1244-147-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB

  • memory/1244-148-0x0000000000400000-0x0000000001A4E000-memory.dmp

    Filesize

    22.3MB