Overview

overview

8

Static

static

5d7d4cefb7...8b.exe

windows7-x64

8

5d7d4cefb7...8b.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    244s
  • max time network
    278s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2022, 06:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    5d7d4cefb71d5689941869f0899c9ce4272055b090e7e400f49a8bac7f83f38b.exe

  • Size

    308KB

  • MD5

    929e8980e08b918a6a5612a861ecb0fa

  • SHA1

    25c6048b7259f48fc238601591c031b96c47111f

  • SHA256

    5d7d4cefb71d5689941869f0899c9ce4272055b090e7e400f49a8bac7f83f38b

  • SHA512

    39472b2465b493b3cb4ae8300071d80106f88aab4f6c71ad63ddbd5fcb437bb8a3e9cfa011ab0a837c2373fd22197704b9f873da1ffca9efa0c8d3f6acf3618d

  • SSDEEP

    6144:8toCLy7vQy+uxvyRzL83I3DzT1/Qw8kCAHpcLHVat281xEO4/mE:o8DQhRLl3zWwz0HVk2yEdm

Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d7d4cefb71d5689941869f0899c9ce4272055b090e7e400f49a8bac7f83f38b.exe
    "C:\Users\Admin\AppData\Local\Temp\5d7d4cefb71d5689941869f0899c9ce4272055b090e7e400f49a8bac7f83f38b.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:876
    • C:\ProgramData\pAmAgObDpPh01804\pAmAgObDpPh01804.exe
      "C:\ProgramData\pAmAgObDpPh01804\pAmAgObDpPh01804.exe" "C:\Users\Admin\AppData\Local\Temp\5d7d4cefb71d5689941869f0899c9ce4272055b090e7e400f49a8bac7f83f38b.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1764

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\pAmAgObDpPh01804\pAmAgObDpPh01804.exe
          Filesize

          308KB

          MD5

          3a1ec2998c95fcfc02d11037100cce0b

          SHA1

          9e2e3fa41cb739f06f45ed5222110925d29d664d

          SHA256

          bf8aa560405a5b958ac63a0834f93020347702cfdbccdbe5ca6a087aadc31b08

          SHA512

          ec2899985c3109c6020a93f960686c2bb7bda81c91ecc3abe3e002687d79d1bad8be13dad982e06258e96325a5d69b0be53c278191082103c2c3bf8af4576fe0

          Download Submit

        • C:\ProgramData\pAmAgObDpPh01804\pAmAgObDpPh01804.exe
          Filesize

          308KB

          MD5

          3a1ec2998c95fcfc02d11037100cce0b

          SHA1

          9e2e3fa41cb739f06f45ed5222110925d29d664d

          SHA256

          bf8aa560405a5b958ac63a0834f93020347702cfdbccdbe5ca6a087aadc31b08

          SHA512

          ec2899985c3109c6020a93f960686c2bb7bda81c91ecc3abe3e002687d79d1bad8be13dad982e06258e96325a5d69b0be53c278191082103c2c3bf8af4576fe0

          Download Submit

        • memory/876-143-0x0000000000400000-0x00000000004FC000-memory.dmp

          Filesize

          1008KB

          Download

        • memory/876-133-0x0000000000659000-0x0000000000687000-memory.dmp

          Filesize

          184KB

          Download

        • memory/876-135-0x0000000000400000-0x00000000004FC000-memory.dmp

          Filesize

          1008KB

          Download

        • memory/876-134-0x0000000000400000-0x00000000004FC000-memory.dmp

          Filesize

          1008KB

          Download

        • memory/876-132-0x0000000000400000-0x00000000004FC000-memory.dmp

          Filesize

          1008KB

          Download

        • memory/876-148-0x0000000000659000-0x0000000000687000-memory.dmp

          Filesize

          184KB

          Download

        • memory/876-147-0x0000000000400000-0x00000000004FC000-memory.dmp

          Filesize

          1008KB

          Download

        • memory/876-144-0x0000000000659000-0x0000000000687000-memory.dmp

          Filesize

          184KB

          Download

        • memory/1764-142-0x0000000000400000-0x00000000004FC000-memory.dmp

          Filesize

          1008KB

          Download

        • memory/1764-141-0x00000000006D8000-0x0000000000706000-memory.dmp

          Filesize

          184KB

          Download

        • memory/1764-145-0x0000000000400000-0x00000000004FC000-memory.dmp

          Filesize

          1008KB

          Download

        • memory/1764-146-0x00000000006D8000-0x0000000000706000-memory.dmp

          Filesize

          184KB

          Download

        • memory/1764-140-0x0000000000400000-0x00000000004FC000-memory.dmp

          Filesize

          1008KB

          Download

        • memory/1764-139-0x0000000000400000-0x00000000004FC000-memory.dmp

          Filesize

          1008KB

          Download