Analysis

  • max time kernel
    165s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 20:57

General

  • Target

    a0d5a5f89d62230b26c57bade0df0ab721110925a6440f306043b5410b18c3ed.exe

  • Size

    230KB

  • MD5

    2c2fa72b1cfcc4e452920f9ab0994177

  • SHA1

    003ada28dfba1ebe2396acf5f0c29a80c9fad266

  • SHA256

    a0d5a5f89d62230b26c57bade0df0ab721110925a6440f306043b5410b18c3ed

  • SHA512

    62009ea9c3f49bfda731d657f525049e04ba61ae13a785177bbcb96f8f48f1a60ed07003b8957410d2a81cbfde7d6d78024567d7a42d42ca0f41ef380809b302

  • SSDEEP

    6144:adT3RRJxSu6ZGGexdkXyeKY6o2aTYRCzEacG:qhRv9xdkXyeKtWT76G

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Nirsoft 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0d5a5f89d62230b26c57bade0df0ab721110925a6440f306043b5410b18c3ed.exe
    "C:\Users\Admin\AppData\Local\Temp\a0d5a5f89d62230b26c57bade0df0ab721110925a6440f306043b5410b18c3ed.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:960
    • C:\Documents and Settings\tazebama.dl_
      "C:\Documents and Settings\tazebama.dl_"
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops autorun.inf file
      • Suspicious behavior: EnumeratesProcesses
      PID:1712

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Documents and Settings\tazebama.dl_

    Filesize

    157KB

    MD5

    87d42c88bd871be7f44f69e34ceaab79

    SHA1

    123de1f20e98905a77a09d6fc65fb85730309fec

    SHA256

    77109419bbad0d4fee337c659555e3ec9dc75f1eaff1c66d9927a33d16d0584f

    SHA512

    314111ce73a9a6ed6b43a1afb9f469e034321aac3f3b547b9329639944116fc92faa15e8e6aa06c4f2eaf7e17f9d4dcafc0752a3c2e34e96941b99ce015ef72e

  • C:\Users\tazebama.dl_

    Filesize

    157KB

    MD5

    87d42c88bd871be7f44f69e34ceaab79

    SHA1

    123de1f20e98905a77a09d6fc65fb85730309fec

    SHA256

    77109419bbad0d4fee337c659555e3ec9dc75f1eaff1c66d9927a33d16d0584f

    SHA512

    314111ce73a9a6ed6b43a1afb9f469e034321aac3f3b547b9329639944116fc92faa15e8e6aa06c4f2eaf7e17f9d4dcafc0752a3c2e34e96941b99ce015ef72e

  • \Users\tazebama.dl_

    Filesize

    157KB

    MD5

    87d42c88bd871be7f44f69e34ceaab79

    SHA1

    123de1f20e98905a77a09d6fc65fb85730309fec

    SHA256

    77109419bbad0d4fee337c659555e3ec9dc75f1eaff1c66d9927a33d16d0584f

    SHA512

    314111ce73a9a6ed6b43a1afb9f469e034321aac3f3b547b9329639944116fc92faa15e8e6aa06c4f2eaf7e17f9d4dcafc0752a3c2e34e96941b99ce015ef72e

  • \Users\tazebama.dl_

    Filesize

    157KB

    MD5

    87d42c88bd871be7f44f69e34ceaab79

    SHA1

    123de1f20e98905a77a09d6fc65fb85730309fec

    SHA256

    77109419bbad0d4fee337c659555e3ec9dc75f1eaff1c66d9927a33d16d0584f

    SHA512

    314111ce73a9a6ed6b43a1afb9f469e034321aac3f3b547b9329639944116fc92faa15e8e6aa06c4f2eaf7e17f9d4dcafc0752a3c2e34e96941b99ce015ef72e

  • \Users\tazebama.dll

    Filesize

    32KB

    MD5

    b6a03576e595afacb37ada2f1d5a0529

    SHA1

    d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8

    SHA256

    1707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad

    SHA512

    181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c

  • memory/960-64-0x0000000000290000-0x00000000002A8000-memory.dmp

    Filesize

    96KB

  • memory/960-63-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/960-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

    Filesize

    8KB

  • memory/960-65-0x0000000000290000-0x00000000002A8000-memory.dmp

    Filesize

    96KB

  • memory/960-66-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/960-67-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/960-68-0x0000000000290000-0x00000000002A8000-memory.dmp

    Filesize

    96KB

  • memory/1712-58-0x0000000000000000-mapping.dmp

  • memory/1712-62-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB