3f8238aa0761c2442330f06b1da4328c99026f2e86ef2ccd22f3cb0c0e2939e0

Analysis

max time kernel
112s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3f8238aa0761c2442330f06b1da4328c99026f2e86ef2ccd22f3cb0c0e2939e0.exe
Size

164KB
MD5

4ae7d1853dd9396936c16aff15ef69d0
SHA1

263f5249dc32194d8a5d7af71b775ac51fd97eb8
SHA256

3f8238aa0761c2442330f06b1da4328c99026f2e86ef2ccd22f3cb0c0e2939e0
SHA512

cf1929485588df4d977da3377803eb8cf3e82ae5f32eec678dbddd9efbb61c93b7d4bcae0e2627d79a9b65ca848dfa32fc5d05269f801a854092b21f633607e0
SSDEEP

3072:W0f4rrWTWhRi/hiGV3wj96shAbqM6YHQ7msh9fW98I1:R6WTMwtwjLh2qM5w7tcx1

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1116	mswin32.exe

Loads dropped DLL 2 IoCs

pid	Process
1476	3f8238aa0761c2442330f06b1da4328c99026f2e86ef2ccd22f3cb0c0e2939e0.exe
1476	3f8238aa0761c2442330f06b1da4328c99026f2e86ef2ccd22f3cb0c0e2939e0.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mswin32.exe	3f8238aa0761c2442330f06b1da4328c99026f2e86ef2ccd22f3cb0c0e2939e0.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1116	mswin32.exe
1476	3f8238aa0761c2442330f06b1da4328c99026f2e86ef2ccd22f3cb0c0e2939e0.exe
1116	mswin32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1116	1476	3f8238aa0761c2442330f06b1da4328c99026f2e86ef2ccd22f3cb0c0e2939e0.exe	27
PID 1476 wrote to memory of 1116	1476	3f8238aa0761c2442330f06b1da4328c99026f2e86ef2ccd22f3cb0c0e2939e0.exe	27
PID 1476 wrote to memory of 1116	1476	3f8238aa0761c2442330f06b1da4328c99026f2e86ef2ccd22f3cb0c0e2939e0.exe	27
PID 1476 wrote to memory of 1116	1476	3f8238aa0761c2442330f06b1da4328c99026f2e86ef2ccd22f3cb0c0e2939e0.exe	27

C:\Users\Admin\AppData\Local\Temp\3f8238aa0761c2442330f06b1da4328c99026f2e86ef2ccd22f3cb0c0e2939e0.exe
"C:\Users\Admin\AppData\Local\Temp\3f8238aa0761c2442330f06b1da4328c99026f2e86ef2ccd22f3cb0c0e2939e0.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\mswin32.exe
  C:\Windows\system32\mswin32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mswin32.exe

Filesize
12KB

MD5
d2d8da644b3aa6e5adac94063e0d2f6d

SHA1
143ffa6da858903603411b6010e7676e54cc3ddc

SHA256
32948017e3265faefef16ee784aaa552ff40ace9c4512d50cad6d230ec888db2

SHA512
c73a7c2e01d57427d80745a87cb2d0977af1f195a0d842fa04fede5944060f85bc3c4954ff59a6fcbaff5dc2b1a545ee6ac20d9a8feb5b6fabe02a5d9e1a4cf9

Download Submit
C:\Windows\SysWOW64\mswin32.exe

Filesize
12KB

MD5
d2d8da644b3aa6e5adac94063e0d2f6d

SHA1
143ffa6da858903603411b6010e7676e54cc3ddc

SHA256
32948017e3265faefef16ee784aaa552ff40ace9c4512d50cad6d230ec888db2

SHA512
c73a7c2e01d57427d80745a87cb2d0977af1f195a0d842fa04fede5944060f85bc3c4954ff59a6fcbaff5dc2b1a545ee6ac20d9a8feb5b6fabe02a5d9e1a4cf9

Download Submit
\Windows\SysWOW64\mswin32.exe

Filesize
12KB

MD5
d2d8da644b3aa6e5adac94063e0d2f6d

SHA1
143ffa6da858903603411b6010e7676e54cc3ddc

SHA256
32948017e3265faefef16ee784aaa552ff40ace9c4512d50cad6d230ec888db2

SHA512
c73a7c2e01d57427d80745a87cb2d0977af1f195a0d842fa04fede5944060f85bc3c4954ff59a6fcbaff5dc2b1a545ee6ac20d9a8feb5b6fabe02a5d9e1a4cf9

Download Submit
\Windows\SysWOW64\mswin32.exe

Filesize
12KB

MD5
d2d8da644b3aa6e5adac94063e0d2f6d

SHA1
143ffa6da858903603411b6010e7676e54cc3ddc

SHA256
32948017e3265faefef16ee784aaa552ff40ace9c4512d50cad6d230ec888db2

SHA512
c73a7c2e01d57427d80745a87cb2d0977af1f195a0d842fa04fede5944060f85bc3c4954ff59a6fcbaff5dc2b1a545ee6ac20d9a8feb5b6fabe02a5d9e1a4cf9

Download Submit
memory/1116-62-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1116-64-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1476-54-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1476-56-0x00000000002C0000-0x00000000002CF000-memory.dmp

Filesize
60KB

Download
memory/1476-61-0x00000000002C0000-0x00000000002CF000-memory.dmp

Filesize
60KB

Download
memory/1476-63-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download