Overview

overview

10

Static

static

10

source_pre...xe.zip

windows7-x64

7

source_pre...xe.zip

windows10-2004-x64

9

Analysis

  • max time kernel
    164s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-12-2024 16:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    source_prepared.exe.zip

  • Size

    75.4MB

  • MD5

    fffaa8e1720e557d41227f11c44bfb3e

  • SHA1

    e0a892b6fa090dc7bbd6b98bc47302bb8a57d24d

  • SHA256

    9328ca674d654ebf6f088456309a666e390d592ebb957483759e70055078392a

  • SHA512

    dff84decfe6af8cdeb1320c9ca7402b3c063d4c7293c5eac3ca07808ef6c837b41b70e07e886564c49da597900a76cf9616e7316a0a3cbd3578447424d76be24

  • SSDEEP

    1572864:o9FlhW622ucy4Zyh/et9riPuodoCbIzZsOC1HZwUVp/BdEbUZb+GYA:oP6622ucdEt42PECMz/C13/BObUYa

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe.zip"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2380
  • C:\Users\Admin\Desktop\source_prepared.exe
    "C:\Users\Admin\Desktop\source_prepared.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2628
    • C:\Users\Admin\Desktop\source_prepared.exe
      "C:\Users\Admin\Desktop\source_prepared.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI26282\python310.dll
    Filesize

    1.4MB

    MD5

    d53251f4484a0092b00b9451423a5e38

    SHA1

    0e15a558ec6ae369147ae07a828c0f9d68dceabe

    SHA256

    9e1dc8da1ed1d0aeacf2b636bd20704d683d0ff15ac0be0c16616a247a9c070b

    SHA512

    ef9ce3c61d2f4b128eb092e9ae32c4433994aa7ba6f6a25e59c2cbd7afb35155becf8941a8c13e17a57902b7bb5022c06bc1dc5e8ccc1c47d22dbe8c39037649

    Download Submit

  • memory/1516-1277-0x000007FEF5E70000-0x000007FEF62DE000-memory.dmp

    Filesize

    4.4MB

    Download