Analysis
-
max time kernel
135s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 15:43
Static task
static1
Behavioral task
behavioral1
Sample
E-ZPass.exe
Resource
win7-20220901-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
E-ZPass.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
E-ZPass.exe
-
Size
124KB
-
MD5
4a91d9752f2272571db1f2fd2da196a0
-
SHA1
6c3c2ac4c7bf6c9a9c5c39f55905c7d0953e5352
-
SHA256
3a7852abd1d15bd1ebc7ce12a3ca3763cebd068208edb4be9fb8a853f2815cee
-
SHA512
bce49c53c39b8b8752ed5d25d744c294de84bf26ee52e7d5eea356da73125a7b32d43a7d2784c2a6fe45bd33108ae4eda15c4547eea0706d9149e558b297cea9
-
SSDEEP
3072:znm47p5CbSMSKi2RjYsslzm2zvitSS2vlsUg2:jV7p5Cbr/vp9slK0b2e
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dhbskhso = "\"C:\\Users\\Admin\\AppData\\Local\\hnpbhkxs.exe\"" svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
E-ZPass.exepid process 1652 E-ZPass.exe 1652 E-ZPass.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
E-ZPass.exedescription pid process target process PID 1652 wrote to memory of 544 1652 E-ZPass.exe svchost.exe PID 1652 wrote to memory of 544 1652 E-ZPass.exe svchost.exe PID 1652 wrote to memory of 544 1652 E-ZPass.exe svchost.exe PID 1652 wrote to memory of 544 1652 E-ZPass.exe svchost.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/544-56-0x0000000000000000-mapping.dmp
-
memory/544-57-0x00000000757A1000-0x00000000757A3000-memory.dmpFilesize
8KB
-
memory/544-58-0x0000000000490000-0x0000000000498000-memory.dmpFilesize
32KB
-
memory/544-59-0x0000000000080000-0x0000000000091000-memory.dmpFilesize
68KB
-
memory/544-60-0x00000000001A0000-0x0000000000220000-memory.dmpFilesize
512KB
-
memory/1652-54-0x0000000000230000-0x0000000000244000-memory.dmpFilesize
80KB