Analysis
-
max time kernel
203s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
24-11-2022 00:35
General
-
Target
1307e8e63c9388c80ffaca8ff5fe4f5e90f6c7ba2c1b7fac921ce51992cbecf3.exe
-
Size
240KB
-
MD5
03f644374095951656c6ee3b31d0baff
-
SHA1
41e1a73672f4366f60d18789acea6524b423f9df
-
SHA256
1307e8e63c9388c80ffaca8ff5fe4f5e90f6c7ba2c1b7fac921ce51992cbecf3
-
SHA512
1ce1eb89051ab570a795d2febfe91f3cbf07bbc425901576f3e34d27df7ec16a9bb2c452f143162746288f0f563cdeadc0188996059165897037fce5ab6a9d66
-
SSDEEP
3072:T2f3wRqQxKvxnsRcaCrGIAtpFO0bikGlY4PwVDRVkYhEfQc3pg3EgzlxM/SxAzgz:iPeyxTiICpFO0yIHc3+3pzluaW0
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1307e8e63c9388c80ffaca8ff5fe4f5e90f6c7ba2c1b7fac921ce51992cbecf3.exe"C:\Users\Admin\AppData\Local\Temp\1307e8e63c9388c80ffaca8ff5fe4f5e90f6c7ba2c1b7fac921ce51992cbecf3.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Documents and Settings\tazebama.dl_"C:\Documents and Settings\tazebama.dl_"2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 7363⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2680 -ip 26801⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Documents and Settings\tazebama.dl_Filesize
151KB
MD51d4da2344958fbc925009ae262492160
SHA1d19dbf9348d19678b15173841ec197c023e85f6d
SHA256ba656395cd5f0149e8fcb55793bed829ba9c18c599250b72033f390afd1202ff
SHA51276a1745952ecbb19049c1464cdafa03b21c89db16538bdf9451a649641908e344ea6720edbc9ba837fffbf715909a9db052a81cee1d046d242473c3d982b82d7
-
C:\Users\tazebama.dl_Filesize
151KB
MD51d4da2344958fbc925009ae262492160
SHA1d19dbf9348d19678b15173841ec197c023e85f6d
SHA256ba656395cd5f0149e8fcb55793bed829ba9c18c599250b72033f390afd1202ff
SHA51276a1745952ecbb19049c1464cdafa03b21c89db16538bdf9451a649641908e344ea6720edbc9ba837fffbf715909a9db052a81cee1d046d242473c3d982b82d7
-
C:\Users\tazebama.dllFilesize
32KB
MD5b6a03576e595afacb37ada2f1d5a0529
SHA1d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8
SHA2561707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad
SHA512181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c
-
memory/1824-132-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1824-134-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1824-138-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2680-135-0x0000000000000000-mapping.dmp
-
memory/2680-139-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2680-140-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB