Overview

overview

10

Static

static

10

[DemonArch...fb.exe

windows7-x64

1

[DemonArch...4e.exe

windows7-x64

7

[DemonArch...86.exe

windows7-x64

[DemonArch...1e.exe

windows7-x64

10

[DemonArch...a6.exe

windows7-x64

7

[DemonArch...a8.exe

windows7-x64

1

[DemonArch...4b.exe

windows7-x64

3

[DemonArch...6b.dll

windows7-x64

1

[DemonArch...23.exe

windows7-x64

8

[DemonArch...38.exe

windows7-x64

10

[DemonArch...94.exe

windows7-x64

10

[DemonArch...03.exe

windows7-x64

5

[DemonArch...96.exe

windows7-x64

10

[DemonArch...f0.dll

windows7-x64

3

[DemonArch...4c.exe

windows7-x64

10

[DemonArch...b3.exe

windows7-x64

1

[DemonArch...44.exe

windows7-x64

[DemonArch...13.exe

windows7-x64

1

[DemonArch...22.exe

windows7-x64

10

[DemonArch...7e.exe

windows7-x64

1

[DemonArch...73.exe

windows7-x64

10

[DemonArch...94.exe

windows7-x64

10

[DemonArch...f6.exe

windows7-x64

[DemonArch...b6.exe

windows7-x64

1

[DemonArch...84.exe

windows7-x64

1

[DemonArch...a0.exe

windows7-x64

10

[DemonArch...9e.exe

windows7-x64

[DemonArch...f2.exe

windows7-x64

[DemonArch...f4.exe

windows7-x64

3

[DemonArch...c8.dll

windows7-x64

1

[DemonArch...85.dll

windows7-x64

10

[DemonArch...71.exe

windows7-x64

Resubmissions

04-07-2024 17:22

240704-vxyavazeql 10

04-07-2024 17:19

240704-vv7rhazenr 10

Analysis

  • max time kernel
    133s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    04-07-2024 17:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    [DemonArchives]6e4f9763c17ea31c3d1406eabd7db423.exe

  • Size

    2.3MB

  • MD5

    6e4f9763c17ea31c3d1406eabd7db423

  • SHA1

    caf959265772132720570fba49b4c40e29a29db3

  • SHA256

    f71bf8405ccbdf8b1e8e0b2ef50ec7b71675dc452ad942f578503e11a58089df

  • SHA512

    018d53cb8c0c56da2cdd6a0f2c3bb5ab786e51a6171f1739234474e8f42f0b52e608c949198ad68bdee21f4d6060c28f6b91a464674d42f0dabc5d1e893c7c7a

  • SSDEEP

    49152:AE13D8c4GG/jfKCfGgc1LCfm7BI/3NtTS/:JHo/OKGF1j7BIPNtT2

Score
8/10
persistenceupx

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Modifies registry class 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\[DemonArchives]6e4f9763c17ea31c3d1406eabd7db423.exe
    "C:\Users\Admin\AppData\Local\Temp\[DemonArchives]6e4f9763c17ea31c3d1406eabd7db423.exe"
    1⤵
      PID:2108
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1764

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1764-17-0x00000000025D0000-0x00000000025E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2108-11-0x0000000000380000-0x000000000052D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2108-12-0x0000000000380000-0x000000000052D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2108-3-0x0000000000380000-0x000000000052D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2108-4-0x0000000000380000-0x000000000052D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2108-5-0x0000000000380000-0x000000000052D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2108-6-0x0000000000380000-0x000000000052D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2108-2-0x0000000000380000-0x000000000052D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2108-0-0x0000000000380000-0x000000000052D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2108-10-0x0000000000380000-0x000000000052D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2108-13-0x0000000000380000-0x000000000052D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2108-14-0x0000000000380000-0x000000000052D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2108-15-0x0000000000380000-0x000000000052D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2108-16-0x0000000000380000-0x000000000052D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2108-1-0x0000000000380000-0x000000000052D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2108-18-0x0000000000380000-0x000000000052D000-memory.dmp

      Filesize

      1.7MB

      Download