5fa565e566196ec50de17af80590b7c945f6d1ab2a1b75e0ad26464c4c70f2ff

Analysis

max time kernel
102s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ba68f9d654a1de51fb0c03eaca58140N.exe
Size

149KB
MD5

9ba68f9d654a1de51fb0c03eaca58140
SHA1

e8456e8d2233f8925bd9983885d94175bacc707d
SHA256

5fa565e566196ec50de17af80590b7c945f6d1ab2a1b75e0ad26464c4c70f2ff
SHA512

0a1c57cf7d29012df5d286c1125e4453aa2a0009b9c379e884c6a3e4326d1403fa7a5926a65deda9035d8124735fde6c14931497947cca199230f365be060276
SSDEEP

3072:2pBvXEzYmorfUc4Gua+I9QsybXtc9acBR6Hcb1pRR7bbxgfKaNAmXjTi1StNm64Z:OWz2Hz9QH69acBBb1TVbbxgfdvXjTY3Z

Score

8^/10

persistence privilege_escalation upx

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
2032	amwoxye.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/740-0-0x0000000000400000-0x000000000045F000-memory.dmp	upx
behavioral2/files/0x0007000000023451-4.dat	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\amwoxye.exe	9ba68f9d654a1de51fb0c03eaca58140N.exe
File created	C:\PROGRA~3\Mozilla\zfeqbre.dll	amwoxye.exe

C:\Users\Admin\AppData\Local\Temp\9ba68f9d654a1de51fb0c03eaca58140N.exe
"C:\Users\Admin\AppData\Local\Temp\9ba68f9d654a1de51fb0c03eaca58140N.exe"
1⤵
- Drops file in Program Files directory
PID:740

C:\PROGRA~3\Mozilla\amwoxye.exe
C:\PROGRA~3\Mozilla\amwoxye.exe -wkgszrd
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla\amwoxye.exe

Filesize
149KB

MD5
c17181e22082f8df8644fb15542561b1

SHA1
29be2927704bcf01fd243e79f03b96ca513f29d9

SHA256
d43213942da0c9d4c184a80186aca1f854fb025c15bb9d29cc665166d25757a3

SHA512
6fc3a27e09be9c2b3db080d964269599258d6f34b3040c1afe5ded429ad0fc74331b23ec74e5a271489ebd500a03fa13e62aafc162102afeda8e9cf42361c1ae

Download Submit
memory/740-0-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/740-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/740-1-0x0000000000700000-0x000000000075B000-memory.dmp

Filesize
364KB

Download
memory/740-7-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2032-9-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2032-8-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2032-12-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download