02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479

Analysis

max time kernel
129s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
16/02/2023, 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.exe
Size

15.8MB
MD5

aec3f6554a36dec7ec9562fd0daeed69
SHA1

a54e1bae0ffe164da3e76c318df7bf986bc8b660
SHA256

02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479
SHA512

2fc6bd07ca248ced95bec04b57b10188b48e5b3f93c55413a0d88851eb1b470f3c4a1945fa6ada2870e0591a0d673e16baa0a894e430d2b8e39f20341277c488
SSDEEP

393216:qBhwbVT8NZBf8l582vT6U/Z7MQEQbKSSqaCb8g0:IwbV3EFyPbKOaCW

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
944	02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.tmp

Loads dropped DLL 3 IoCs

pid	Process
1724	02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.exe
944	02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.tmp
944	02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
944	02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 944	1724	02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.exe	28
PID 1724 wrote to memory of 944	1724	02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.exe	28
PID 1724 wrote to memory of 944	1724	02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.exe	28
PID 1724 wrote to memory of 944	1724	02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.exe	28

C:\Users\Admin\AppData\Local\Temp\02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.exe
"C:\Users\Admin\AppData\Local\Temp\02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\is-7JQ8D.tmp\02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7JQ8D.tmp\02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.tmp" /SL5="$70126,16225014,79872,C:\Users\Admin\AppData\Local\Temp\02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-7JQ8D.tmp\02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.tmp

Filesize
733KB

MD5
ff1ddfe4619bfff923fb5cbb5753fa2b

SHA1
3c0adfde84292c47ccd83fc3d5f6f35a2f84a6af

SHA256
0ddbe902f4e340b1a5bb4c79a1cdc55607114bb59bb678e2e38c41b69737a59a

SHA512
6419798d2afa462e5c689e0c09826d4f51a3fef659e681de8312edda8e7da0ab5bb932fe62eb9af7d0e34b7fe3a2cb6e43fdfbd6be785de00a8648eaff9840fd

Download Submit
\Users\Admin\AppData\Local\Temp\is-7JQ8D.tmp\02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.tmp

Filesize
733KB

MD5
ff1ddfe4619bfff923fb5cbb5753fa2b

SHA1
3c0adfde84292c47ccd83fc3d5f6f35a2f84a6af

SHA256
0ddbe902f4e340b1a5bb4c79a1cdc55607114bb59bb678e2e38c41b69737a59a

SHA512
6419798d2afa462e5c689e0c09826d4f51a3fef659e681de8312edda8e7da0ab5bb932fe62eb9af7d0e34b7fe3a2cb6e43fdfbd6be785de00a8648eaff9840fd

Download Submit
\Users\Admin\AppData\Local\Temp\is-JJ2RE.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-JJ2RE.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/1724-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1724-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1724-61-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads