Analysis

  • max time kernel
    91s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/11/2024, 12:06

General

  • Target

    f2e7f09f6fe98a130e5b96531c327e419e273729f6aaa218b6918ed3e564c7fd.exe

  • Size

    944KB

  • MD5

    32eea9cb52ac61c5a73d45baea3a8c24

  • SHA1

    5cd2600b24e0eaa94e225f5f3f571a1842a99381

  • SHA256

    f2e7f09f6fe98a130e5b96531c327e419e273729f6aaa218b6918ed3e564c7fd

  • SHA512

    cb895ad909a37197daa0a3a8447de3d5278270d3f690b24c15137269a20409d67fdd106b29e7b591e4ec3c934be262e8f4a4d8d014b44a5665960a38c2e26b9b

  • SSDEEP

    24576:v6Zv2ivhBVnFvh5Q44+iiEb0f2Q5tZz1MrVTPh14w:vE2ivhhUK9f9DpMD1T

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 6 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f2e7f09f6fe98a130e5b96531c327e419e273729f6aaa218b6918ed3e564c7fd.exe
    "C:\Users\Admin\AppData\Local\Temp\f2e7f09f6fe98a130e5b96531c327e419e273729f6aaa218b6918ed3e564c7fd.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Windows\svchost.exe
      C:\Windows\svchost.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:2712

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\concp32.exe

          Filesize

          948KB

          MD5

          930f76c4f0f7dd6d6ee8b1dfe2a28065

          SHA1

          b79de22e2dcf4bb807af9e9e74a031af38afd8b4

          SHA256

          22f50e25a65ff0691a382f3c672cedee5951581ddb543a9db2f1293c08ca397c

          SHA512

          5040e234d83c839571310ab40c0e73f907b50b8e24e18dd30d8dab857630d7f9031781a5af4b47e917578fec751e4a7f8051db13486a54c25d1527d7de87ad0b

        • C:\Windows\svchost.exe

          Filesize

          949KB

          MD5

          183f93116d1dcf3215472d7c1aa05964

          SHA1

          625af0a067ed65e3c11c958ab70b75ca41d5d239

          SHA256

          2dc431b47a23034024a7efb19e2a1b2d35c7fa30035c2355ea0ee75fc7843fa2

          SHA512

          b4c5a75dab37957e33f1495fffb4baf422f6fb0e684c3a8a997371f3b1348385879104454d9664001c6d4a68c5f31515de5ca1cbc571342a83d9289575c0909b

        • memory/2088-0-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/2088-13-0x00000000002D0000-0x0000000000309000-memory.dmp

          Filesize

          228KB

        • memory/2088-15-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/2712-16-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB