9a8deeb20847805e19540b951071d8387daf72f893f44f50dd39fba217c2c5be

Analysis

max time kernel
46s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11-02-2023 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a8deeb20847805e19540b951071d8387daf72f893f44f50dd39fba217c2c5be.exe
Size

3.9MB
MD5

935e7241c082de639377d53122d707f9
SHA1

c9d897fded55d671358bc896e410db7dd27664d5
SHA256

9a8deeb20847805e19540b951071d8387daf72f893f44f50dd39fba217c2c5be
SHA512

474520e4e62d4f8eb5dce5cf0e24b4a302ac5cdbbb8dfb2631e46bb482b0b6aa2989430a3df750348eb9f62aa527c3d01f96fe81834c1e9c1e8ac5b8d6dae74d
SSDEEP

98304:I6oI4xZW+NFdJlFoBFHlTo+kT84bggD5FLOAkGkzdnEVomFHKnP4:IFI4m6FdJeAdbggD5FLOyomFHKnP4

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	9a8deeb20847805e19540b951071d8387daf72f893f44f50dd39fba217c2c5be.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1256	9a8deeb20847805e19540b951071d8387daf72f893f44f50dd39fba217c2c5be.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1256	9a8deeb20847805e19540b951071d8387daf72f893f44f50dd39fba217c2c5be.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1256	9a8deeb20847805e19540b951071d8387daf72f893f44f50dd39fba217c2c5be.exe
1256	9a8deeb20847805e19540b951071d8387daf72f893f44f50dd39fba217c2c5be.exe

C:\Users\Admin\AppData\Local\Temp\9a8deeb20847805e19540b951071d8387daf72f893f44f50dd39fba217c2c5be.exe
"C:\Users\Admin\AppData\Local\Temp\9a8deeb20847805e19540b951071d8387daf72f893f44f50dd39fba217c2c5be.exe"
1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download