Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    12/09/2024, 13:02

General

  • Target

    3edf17f985bf68be123edc894fd61190N.exe

  • Size

    5.7MB

  • MD5

    3edf17f985bf68be123edc894fd61190

  • SHA1

    8e2cd7b91073c1d792972742b89974f3ccfec3c7

  • SHA256

    2f348d6a86b7c5196f1e8e44de7e4f4716707af48367e3746e960bf0099c8fdf

  • SHA512

    051a23653fbae90df49e28f8a059eee681e7c19ae33df3be865929332a84a14ed198979fbbcaa410cfa78900f8384bb8a0dbf40fc873ffe8c0f703c0738208e4

  • SSDEEP

    98304:gCQUA1OjhJTlBR1AebLrfjBevMu9Rqxkgn6lnwOmQvcQunlmoixgeXueb1:gCPhh1RrbLrfjBYRFbnR1EQunlmokgeb

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3edf17f985bf68be123edc894fd61190N.exe
    "C:\Users\Admin\AppData\Local\Temp\3edf17f985bf68be123edc894fd61190N.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Users\Admin\AppData\Local\Temp\3edf17f985bf68be123edc894fd61190N.exe
      "C:\Users\Admin\AppData\Local\Temp\3edf17f985bf68be123edc894fd61190N.exe"
      2⤵
        PID:2800

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2056-0-0x000000013F7A0000-0x00000001402B0000-memory.dmp

      Filesize

      11.1MB

    • memory/2056-1-0x0000000001DA0000-0x00000000028B0000-memory.dmp

      Filesize

      11.1MB

    • memory/2056-2-0x000000013F7A0000-0x00000001402B0000-memory.dmp

      Filesize

      11.1MB

    • memory/2056-4-0x0000000001DA0000-0x00000000028B0000-memory.dmp

      Filesize

      11.1MB