eb8b5d81542da02c06dedc42f238cfb533b5c72310df4f224124bb2578cf9259

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

photofacefun/photofacefun.exe
Size

3.1MB
MD5

0228e508dfcfa2be22bc20eefc337151
SHA1

90e20b0f03d4ecac11a9e4d798c6cde8499e7137
SHA256

4cbab17516331c9f605c812d510baaf0c5b1cb646df31948e1f79223d1457357
SHA512

a4e6739f1edd0b41a73652c54e51dc0010e4948dc5c24157abe4a85eb8f5f372cfefc948cd983de1c1f11ef035ba5932b966976d12ec014d697680e14d2ab848
SSDEEP

98304:vRfzK+NFkLY0WMl+X+h+fKay6JQGn1NMLtN:5fudYts+jeda+

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2968-0-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2968-1-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2968-2-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2968-3-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2968-4-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2968-5-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2968-6-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2968-7-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2968-8-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2968-9-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2968-10-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2968-11-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2968-12-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2968-13-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2968-14-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2968-15-0x0000000000400000-0x0000000000586000-memory.dmp	upx

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	photofacefun.exe
File opened (read-only)	\??\B:	photofacefun.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2968	photofacefun.exe
2968	photofacefun.exe

C:\Users\Admin\AppData\Local\Temp\photofacefun\photofacefun.exe
"C:\Users\Admin\AppData\Local\Temp\photofacefun\photofacefun.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2968-0-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2968-1-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2968-2-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2968-3-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2968-4-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2968-5-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2968-6-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2968-7-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2968-8-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2968-9-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2968-10-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2968-11-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2968-12-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2968-13-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2968-14-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2968-15-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download