Analysis

  • max time kernel
    29s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    10-05-2023 12:52

General

  • Target

    4151bfdd1db1f0f693ee701d8d0f329d49992b2169ac251089335296cb3b4c96.exe

  • Size

    4.5MB

  • MD5

    09217841988e0cdb9c6a62c2ce8042cb

  • SHA1

    e6ff53302c09b0ffe4b9c3115d9fe924b485a13a

  • SHA256

    4151bfdd1db1f0f693ee701d8d0f329d49992b2169ac251089335296cb3b4c96

  • SHA512

    e5cb5aa8d311ab15649c72c0ec648e6ba7579db5a6ab7364cf28d100508606654cab542ef23c803504e0322388e4ef2cff8c146aad2b30a2df667c122df8305e

  • SSDEEP

    49152:HITFwuUfkWk5cS7a+9XYaQkZehc4mTYJ78V9gyBn4cBfmP/SA8N:oTwXajJ3Z942KQV9hp4QfmP/SA8

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4151bfdd1db1f0f693ee701d8d0f329d49992b2169ac251089335296cb3b4c96.exe
    "C:\Users\Admin\AppData\Local\Temp\4151bfdd1db1f0f693ee701d8d0f329d49992b2169ac251089335296cb3b4c96.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1424
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
      2⤵
        PID:1880

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads