Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    05/07/2024, 02:52

General

  • Target

    2fac07337599fd89258bdca05330eaac6055d68622053890a2235f13e1c64214.exe

  • Size

    9.7MB

  • MD5

    44250fcc122e675bad7ae5c12c36c290

  • SHA1

    5d256c178212491566460c18c91b29159572ed49

  • SHA256

    2fac07337599fd89258bdca05330eaac6055d68622053890a2235f13e1c64214

  • SHA512

    da21d36c6aef45b2c37544a764c4f925503d59e9ed9a8f0e5bdf812f5897342fa02326070598076a631c89eb7868d11fadb219c7ed129531d9a38143bd842371

  • SSDEEP

    196608:liCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:le

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2fac07337599fd89258bdca05330eaac6055d68622053890a2235f13e1c64214.exe
    "C:\Users\Admin\AppData\Local\Temp\2fac07337599fd89258bdca05330eaac6055d68622053890a2235f13e1c64214.exe"
    1⤵
    • Drops file in System32 directory
    PID:2132
  • C:\Windows\SysWOW64\svrwsc.exe
    C:\Windows\SysWOW64\svrwsc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\svrwsc.exe

    Filesize

    9.8MB

    MD5

    b449f4c9350fdd280c7a68bf45ccb576

    SHA1

    f818c99884e793ba14f6ca10dc43fd870412b1fc

    SHA256

    a862260d7929766e3b9258d22afe14483b8bc81c020524a6d46594ade1261286

    SHA512

    6e0497eb93e91e69802f07bf9f0456d945c117de1cdcb98b4d2c21bfbd191f56835bb8e50d8a1025698b28ac4da777e5a06f3ee286b43fbb2cbb831e5c10a7cc

  • memory/1184-6-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2132-0-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2132-2-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2132-1-0x00000000003B0000-0x00000000003B5000-memory.dmp

    Filesize

    20KB

  • memory/2132-8-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB