Overview

overview

10

Static

static

10

[DemonArch...f3.exe

windows7-x64

10

[DemonArch...5e.exe

windows7-x64

10

[DemonArch...a8.exe

windows7-x64

10

[DemonArch...55.exe

windows7-x64

[DemonArch...9c.exe

windows7-x64

8

[DemonArch...ac.exe

windows7-x64

10

[DemonArch...0f.exe

windows7-x64

10

[DemonArch...94.exe

windows7-x64

10

[DemonArch...7e.exe

windows7-x64

8

[DemonArch...5a.exe

windows7-x64

1

[DemonArch...c4.exe

windows7-x64

[DemonArch...f3.exe

windows7-x64

10

[DemonArch...8f.exe

windows7-x64

10

[DemonArch...85.exe

windows7-x64

10

[DemonArch...92.exe

windows7-x64

9

[DemonArch...5b.exe

windows7-x64

10

[DemonArch...59.exe

windows7-x64

7

[DemonArch...0f.exe

windows7-x64

10

[DemonArch...61.exe

windows7-x64

10

[DemonArch...16.exe

windows7-x64

10

[DemonArch...23.exe

windows7-x64

[DemonArch...6d.exe

windows7-x64

10

[DemonArch...af.exe

windows7-x64

10

[DemonArch...5c.exe

windows7-x64

10

[DemonArch...52.exe

windows7-x64

10

[DemonArch...af.exe

windows7-x64

10

[DemonArch...fa.exe

windows7-x64

10

[DemonArch...f1.exe

windows7-x64

7

[DemonArch...7b.exe

windows7-x64

10

[DemonArch...02.exe

windows7-x64

10

[DemonArch...80.exe

windows7-x64

[DemonArch...c8.exe

windows7-x64

8

Resubmissions

04-07-2024 17:22

240704-vxyavazeql 10

04-07-2024 17:19

240704-vv7rhazenr 10

Analysis

  • max time kernel
    299s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04-07-2024 17:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    [DemonArchives]55a0c8c7e6c8b2be4ebd164d43e746c8.exe

  • Size

    1.9MB

  • MD5

    55a0c8c7e6c8b2be4ebd164d43e746c8

  • SHA1

    151a6ebb2706eef6cef9fbc51a5d959bb7b14cb0

  • SHA256

    d3bbd8f6427e98b303c5a447acc3a98d6229369d096fbb77609de87cdff88d63

  • SHA512

    db6f6beb20eb74b8da5e36e1758d8dde900eb1ce839ad4769691ef08f2e14b7f678530d306e14e123fa203eef6b373426445162b5c4ccb901dcd1e229ce2f098

  • SSDEEP

    49152:hE13D8c4GG/jfKCfGgv58UunQ7M+lFVhSekhg:0Ho/OKG2un9gFrSeL

Score
8/10
persistenceupx

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • UPX packed file 30 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Modifies registry class 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\[DemonArchives]55a0c8c7e6c8b2be4ebd164d43e746c8.exe
    "C:\Users\Admin\AppData\Local\Temp\[DemonArchives]55a0c8c7e6c8b2be4ebd164d43e746c8.exe"
    1⤵
      PID:2160
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2892

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2160-24-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-33-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-18-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-3-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-4-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-5-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-6-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-10-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-11-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-12-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-13-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-14-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-15-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-16-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-2-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-19-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-1-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-20-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-21-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-22-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-23-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-0-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-25-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-26-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-27-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-28-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-29-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-30-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-31-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2160-32-0x00000000008A0000-0x0000000000A4D000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2892-17-0x00000000025D0000-0x00000000025E0000-memory.dmp

      Filesize

      64KB

      Download