Analysis

  • max time kernel
    130s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 15:37

General

  • Target

    3dbf96df235ec1ff38f66c4e826528a365d687d85af7d9086fd12dd95362f6b6.exe

  • Size

    556KB

  • MD5

    c529d9431bdf812cd3fb702a4fd8ada8

  • SHA1

    dd3459a7051eaa34cd28c0c3dd133efa1dead013

  • SHA256

    3dbf96df235ec1ff38f66c4e826528a365d687d85af7d9086fd12dd95362f6b6

  • SHA512

    dcc787c8ce5b29bc0866058b6c4e27b1fb616932ad16f4c832952241823b23ae56ba10846ed69e5e9f4162e4aef948e1630e267158a0991e9d9b4c1466c86138

  • SSDEEP

    12288:UsAqMGHGSX1388BxGVI43d+FPRjw/ksYtXtaFEuMmUUDxAbOeuAybAkb:UsBbW1Wc/C9EEuMmT+Kdr

Score
10/10

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3dbf96df235ec1ff38f66c4e826528a365d687d85af7d9086fd12dd95362f6b6.exe
    "C:\Users\Admin\AppData\Local\Temp\3dbf96df235ec1ff38f66c4e826528a365d687d85af7d9086fd12dd95362f6b6.exe"
    1⤵
    • Modifies system executable filetype association
    • Modifies Installed Components in the registry
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:272
    • C:\Windows\spoolsv.exe
      C:\Windows\spoolsv.exe
      2⤵
      • Modifies system executable filetype association
      • Executes dropped EXE
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      • Modifies registry class
      PID:2008

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\spoolsv.exe

    Filesize

    557KB

    MD5

    4dce2b27e1a7c09b9587376e2a7ed7a0

    SHA1

    6fbb5b967d8cf5bf78895b13e5e90cd478a61bff

    SHA256

    3968a3ae40cdef1e4d1e53c76dc365d0af0f7f7b96182b390a2ff03f393cc161

    SHA512

    fcfc50616f3a2e022a3a062587d2d8e2fc503cbae4edf971d9770b6425a35c73634aae17bfd5b227456ab84e8c63572afa4d29b161506605be1f510d864d5564

  • memory/272-54-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/272-57-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2008-55-0x0000000000000000-mapping.dmp

  • memory/2008-58-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2008-59-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB