Analysis
-
max time kernel
90s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 10:46
Static task
static1
Behavioral task
behavioral1
Sample
63d638fa7574431cb0051a256048bd6d9cf5bc2de12497a4a945ea0ff264d5a7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
63d638fa7574431cb0051a256048bd6d9cf5bc2de12497a4a945ea0ff264d5a7.exe
Resource
win10v2004-20220812-en
General
-
Target
63d638fa7574431cb0051a256048bd6d9cf5bc2de12497a4a945ea0ff264d5a7.exe
-
Size
130KB
-
MD5
7280f3459bd673ea64e8cfb64aee76e0
-
SHA1
7a4e0f3c8c40917a413de98c110c20a452550c07
-
SHA256
63d638fa7574431cb0051a256048bd6d9cf5bc2de12497a4a945ea0ff264d5a7
-
SHA512
a563b4d8ecbab2a44fd677e944e9cc8c736cd5e34839adc95f9f69485f64b6c532c86362df13c563beb51c524ebb5bf2ef798178e4c7e3f0468626d863f57531
-
SSDEEP
3072:SDv4WnhNknkglLUgXFEba06+LJlIP13lB:Sr4WP+kg5U6FEba06A813b
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
63d638fa7574431cb0051a256048bd6d9cf5bc2de12497a4a945ea0ff264d5a7.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 63d638fa7574431cb0051a256048bd6d9cf5bc2de12497a4a945ea0ff264d5a7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 63d638fa7574431cb0051a256048bd6d9cf5bc2de12497a4a945ea0ff264d5a7.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
63d638fa7574431cb0051a256048bd6d9cf5bc2de12497a4a945ea0ff264d5a7.exepid process 1004 63d638fa7574431cb0051a256048bd6d9cf5bc2de12497a4a945ea0ff264d5a7.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
63d638fa7574431cb0051a256048bd6d9cf5bc2de12497a4a945ea0ff264d5a7.exedescription pid process target process PID 1004 wrote to memory of 1400 1004 63d638fa7574431cb0051a256048bd6d9cf5bc2de12497a4a945ea0ff264d5a7.exe svchost.exe PID 1004 wrote to memory of 1400 1004 63d638fa7574431cb0051a256048bd6d9cf5bc2de12497a4a945ea0ff264d5a7.exe svchost.exe PID 1004 wrote to memory of 1400 1004 63d638fa7574431cb0051a256048bd6d9cf5bc2de12497a4a945ea0ff264d5a7.exe svchost.exe PID 1004 wrote to memory of 1400 1004 63d638fa7574431cb0051a256048bd6d9cf5bc2de12497a4a945ea0ff264d5a7.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63d638fa7574431cb0051a256048bd6d9cf5bc2de12497a4a945ea0ff264d5a7.exe"C:\Users\Admin\AppData\Local\Temp\63d638fa7574431cb0051a256048bd6d9cf5bc2de12497a4a945ea0ff264d5a7.exe"1⤵
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1004-54-0x0000000000400000-0x0000000000521000-memory.dmpFilesize
1.1MB
-
memory/1004-55-0x0000000075211000-0x0000000075213000-memory.dmpFilesize
8KB
-
memory/1004-56-0x0000000000570000-0x0000000000589000-memory.dmpFilesize
100KB
-
memory/1004-57-0x0000000000400000-0x0000000000521000-memory.dmpFilesize
1.1MB
-
memory/1004-58-0x00000000026A0000-0x00000000026B9000-memory.dmpFilesize
100KB
-
memory/1004-59-0x0000000000570000-0x0000000000589000-memory.dmpFilesize
100KB
-
memory/1400-60-0x0000000000000000-mapping.dmp
-
memory/1400-62-0x0000000000080000-0x0000000000093000-memory.dmpFilesize
76KB
-
memory/1400-63-0x0000000000020000-0x0000000000039000-memory.dmpFilesize
100KB