36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24

Analysis

max time kernel
28s
max time network
55s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 22:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe
Size

26KB
MD5

5a30923c9968c5d87e0927c55e053cc0
SHA1

d8b35ed4050ac51ee56f326764d06e3c4a8bec8a
SHA256

36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24
SHA512

ab13928f950b9e39dafe174baec664abfbf99d4d6c05ab2c0889d97c492c17d6a839f1d0a77c6932ca625aef8acdb2ccc5d9fe9970245d84e447e25dc8fbdaf7
SSDEEP

768:ir9j8kj868R8x8C888Q8E8m8E827uie00dEjSKWuCMdt+W:i9Zjzq2fhbp1pJ7uieNSrFt+

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
304	svchost.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1324 set thread context of 940	1324	36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
940	36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
940	36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe
940	36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 940	1324	36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe	28
PID 1324 wrote to memory of 940	1324	36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe	28
PID 1324 wrote to memory of 940	1324	36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe	28
PID 1324 wrote to memory of 940	1324	36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe	28
PID 1324 wrote to memory of 940	1324	36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe	28
PID 1324 wrote to memory of 940	1324	36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe	28
PID 1324 wrote to memory of 940	1324	36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe	28
PID 940 wrote to memory of 304	940	36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe	29
PID 940 wrote to memory of 304	940	36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe	29
PID 940 wrote to memory of 304	940	36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe	29
PID 940 wrote to memory of 304	940	36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe	29

C:\Users\Admin\AppData\Local\Temp\36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe
"C:\Users\Admin\AppData\Local\Temp\36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1324
- \??\c:\users\admin\appdata\local\temp\36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe
  "c:\users\admin\appdata\local\temp\36847ed11dcc4845e78a6816dcd428c55741c66aa64043a2cd25e79463ebbb24.exe"
  2⤵
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\syswow64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - Deletes itself
    PID:304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/304-62-0x0000000000EE0000-0x0000000000EE8000-memory.dmp

Filesize
32KB

Download
memory/304-63-0x0000000000080000-0x0000000000084000-memory.dmp

Filesize
16KB

Download
memory/304-64-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/304-65-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/940-54-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/940-55-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/940-57-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/940-60-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1324-59-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download