Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2024, 21:05

General

  • Target

    free hecks.exe

  • Size

    20.2MB

  • MD5

    53b134826d5c036f87e2acc22b10b159

  • SHA1

    50c698af25e92c46d78e04519454389fca9795fb

  • SHA256

    0e414694d08123f2f0639603ff0f3c8105554653d393a20d42b295cc74882244

  • SHA512

    bbfc7ee8e65fe2209b0f4186c5eb1309940b804694e746f96bcfa050bc41654e14b727923d934b459676d2cfe4747b3f2c9ab4ec3cef005f4ccbbf1a7e154c3b

  • SSDEEP

    393216:q2L7Y1RtByxjXBYFzLNHyZOOOOOOOOOOOOOn3F7nSGt7G/8MQc/jTiNV2ZgZdZnL:UtAj2PyUln+PQajEV2Z23F

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\free hecks.exe
    "C:\Users\Admin\AppData\Local\Temp\free hecks.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Users\Admin\AppData\Local\Temp\free hecks.exe
      "C:\Users\Admin\AppData\Local\Temp\free hecks.exe"
      2⤵
      • Loads dropped DLL
      PID:2080

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\_MEI23442\api-ms-win-core-file-l1-2-0.dll

          Filesize

          21KB

          MD5

          4a060eec454c222a5381cd359dc00b81

          SHA1

          21e1bc115d04a74779e955ea16a16bd71454d9bb

          SHA256

          e6b2b05e14a6c6f5381e8f4c7f4fd28a499246fb4c8eafe1f08014b9273d70df

          SHA512

          16fb1f4ccdad05d07feb62e0cd078401f4023f9fab0fb15e52b927ca413e65eb32c2932ba59dbfa7f7ee0e8a8053748e27f2757e82e600db812271aa44a9433c

        • C:\Users\Admin\AppData\Local\Temp\_MEI23442\api-ms-win-core-file-l2-1-0.dll

          Filesize

          20KB

          MD5

          50abf0a7ee67f00f247bada185a7661c

          SHA1

          0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1

          SHA256

          f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7

          SHA512

          c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

        • C:\Users\Admin\AppData\Local\Temp\_MEI23442\api-ms-win-core-localization-l1-2-0.dll

          Filesize

          21KB

          MD5

          4c26932f8f1f490017add31f5ec0a533

          SHA1

          0da01a7c89b506fe3fd939344bb51b976efb3207

          SHA256

          dd3843c2e46b4e926c36150d614efe02ca0ebc1f767f64f471568adc35c2ef23

          SHA512

          eb2b87d187991fdc8e3a6577f20622d2d4a2a994dd375d8c27e1434ce786596533eacfbde8714db9959d88d6bcb91fdc8079c60c23f0eb920ba45c546a44e523

        • C:\Users\Admin\AppData\Local\Temp\_MEI23442\api-ms-win-core-processthreads-l1-1-1.dll

          Filesize

          21KB

          MD5

          a6776c201baae1dd6f88048d7747d14c

          SHA1

          646119d2e440e6dad0ffb0fe449ab4fc27f09fbe

          SHA256

          ee99af71c347ff53c4e15109cb597759e657a3e859d9530680eeea8bb0540112

          SHA512

          a9137af8529fd96dbba22c5179a16d112ec0bfab9792babe0a9f1cca27408eff73ba89f498cb5f941a5aa44555529ee10484e6ca4a3fbf1627523acfde622b45

        • C:\Users\Admin\AppData\Local\Temp\_MEI23442\api-ms-win-core-timezone-l1-1-0.dll

          Filesize

          21KB

          MD5

          10d466341e7ece8cf75b5d026105741b

          SHA1

          31d1e9b9a4511156695b5aa33d65b6a36f8139c2

          SHA256

          5ce391edb33c7055e724a4c3cecc64d16ba2aa4724cb99cd5aed00b0cecfbc82

          SHA512

          8778fd10c7360bd87db048a2b2ca6603455fd8cb4d0e18709f106b55db7cc92e7d6dc45385ff9def445b368376462e7d253442728d5e759faa97299b67a59e21

        • C:\Users\Admin\AppData\Local\Temp\_MEI23442\python310.dll

          Filesize

          1.4MB

          MD5

          b93eda8cc111a5bde906505224b717c3

          SHA1

          5f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e

          SHA256

          efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983

          SHA512

          b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba

        • C:\Users\Admin\AppData\Local\Temp\_MEI23442\ucrtbase.dll

          Filesize

          1.1MB

          MD5

          3b337c2d41069b0a1e43e30f891c3813

          SHA1

          ebee2827b5cb153cbbb51c9718da1549fa80fc5c

          SHA256

          c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

          SHA512

          fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

        • memory/2080-170-0x000007FEF5CB0000-0x000007FEF6115000-memory.dmp

          Filesize

          4.4MB