c45e3cae9af95fb8b72764a88976fef6413bc4ae08cefc8d49a799120a7700a0

Analysis

max time kernel
141s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c45e3cae9af95fb8b72764a88976fef6413bc4ae08cefc8d49a799120a7700a0.exe
Size

517KB
MD5

80384b5c8c5a914064eaade582bb7dcd
SHA1

10e67be93e13a7c68095bc49c2c051b477451f59
SHA256

c45e3cae9af95fb8b72764a88976fef6413bc4ae08cefc8d49a799120a7700a0
SHA512

8814acc2acf2c8f2b42569c59046f451f92219436a41ccf6981a24b86f859c1c0e6f8a5f244efb4ccb079c826808cd60880c22b7a262729fd7cd41665173d15a
SSDEEP

12288:avHH/ovbsTABBVFMcw+mehf2Wb9E8rmotxUB:USUOF38e8eE8rme

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/740-0-0x0000000000400000-0x0000000000582000-memory.dmp	upx
behavioral2/memory/740-39-0x0000000000400000-0x0000000000582000-memory.dmp	upx

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	c45e3cae9af95fb8b72764a88976fef6413bc4ae08cefc8d49a799120a7700a0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	c45e3cae9af95fb8b72764a88976fef6413bc4ae08cefc8d49a799120a7700a0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	c45e3cae9af95fb8b72764a88976fef6413bc4ae08cefc8d49a799120a7700a0.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	c45e3cae9af95fb8b72764a88976fef6413bc4ae08cefc8d49a799120a7700a0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	c45e3cae9af95fb8b72764a88976fef6413bc4ae08cefc8d49a799120a7700a0.exe

C:\Users\Admin\AppData\Local\Temp\c45e3cae9af95fb8b72764a88976fef6413bc4ae08cefc8d49a799120a7700a0.exe
"C:\Users\Admin\AppData\Local\Temp\c45e3cae9af95fb8b72764a88976fef6413bc4ae08cefc8d49a799120a7700a0.exe"
1⤵
- Enumerates system info in registry
PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Config.ini

Filesize
92B

MD5
a6200c143fdd166b5fb3b9e875963440

SHA1
b9d535aab75a3c247b0d73bbef20761f6015cc19

SHA256
5a87cdcf927ad36711f9cc16834b9337e4d7f376f677a919be9903d4bca9e4e3

SHA512
6236e3a6b398ef219acccbec027afbf393a4b8a4b4c393e788a9fcfe1745402db492f1ef241175b293fa7129fe4a4af4a857bf655407a127aaf87db7bc713b72

Download Submit
memory/740-0-0x0000000000400000-0x0000000000582000-memory.dmp

Filesize
1.5MB

Download
memory/740-1-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Filesize
4KB

Download
memory/740-2-0x0000000000403000-0x0000000000404000-memory.dmp

Filesize
4KB

Download
memory/740-39-0x0000000000400000-0x0000000000582000-memory.dmp

Filesize
1.5MB

Download
memory/740-41-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Filesize
4KB

Download