73117c050f010c717b092fdff7aa937ef59dc679c0e38dcfd26039b501a1871e

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29ad5133c654354f16eb2ec557ac1489faed243aa6dba51e4a86e970e455fa5c.exe
Size

375KB
MD5

3253fb46bf94faf1601d46df9b0e844c
SHA1

29bf4e6f63b278f068c72fdc9a108b60d1824a20
SHA256

29ad5133c654354f16eb2ec557ac1489faed243aa6dba51e4a86e970e455fa5c
SHA512

08ba770983bd5f08c912d423ad51e0cfa3bd33fc73f820a324d527db56ff8d6f7b06d7a967ee98e3c3aafc1bca3b14a9979efa0fe35f8f17ff1128281b74ab07
SSDEEP

6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIDYbW8hA/XeAJLz0:v6Wq4aaE6KwyF5L0Y2D1PqLiq8hA/5JA

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4720-0-0x0000000000400000-0x00000000004C2000-memory.dmp	upx
behavioral2/memory/4720-1-0x0000000000400000-0x00000000004C2000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4720-1-0x0000000000400000-0x00000000004C2000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29ad5133c654354f16eb2ec557ac1489faed243aa6dba51e4a86e970e455fa5c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4720	29ad5133c654354f16eb2ec557ac1489faed243aa6dba51e4a86e970e455fa5c.exe
4720	29ad5133c654354f16eb2ec557ac1489faed243aa6dba51e4a86e970e455fa5c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	29ad5133c654354f16eb2ec557ac1489faed243aa6dba51e4a86e970e455fa5c.exe

C:\Users\Admin\AppData\Local\Temp\29ad5133c654354f16eb2ec557ac1489faed243aa6dba51e4a86e970e455fa5c.exe
"C:\Users\Admin\AppData\Local\Temp\29ad5133c654354f16eb2ec557ac1489faed243aa6dba51e4a86e970e455fa5c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4720-0-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4720-1-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download