4190ee00a01fd7d6693ae933c9bd37f532ba6df94a4822f07bb9bdf375fc745b

Analysis

max time kernel
140s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29-05-2023 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4190ee00a01fd7d6693ae933c9bd37f532ba6df94a4822f07bb9bdf375fc745b.exe
Size

404KB
MD5

8b3e76641feadf1ebf43963bbebffeb5
SHA1

ba59535c8b37114a3447e9fc6ba5c81eb7e81397
SHA256

4190ee00a01fd7d6693ae933c9bd37f532ba6df94a4822f07bb9bdf375fc745b
SHA512

b902ad76890ce70e45019fac44c4136b10168213b30fcc20e1c6922984af3ac27ce629a3d6d2bc57673f8f6ed9dc02da67097790a19a405e397f12cf2c12af19
SSDEEP

6144:MctelQhz2LNJuzz49r+4TGBb9iYqyuPlLUVe9OwOAWHYSea6hkId6mdgytvEGe7:MplQhzsKkVRGbDqFlQM4wOAy0hbdgic

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4190ee00a01fd7d6693ae933c9bd37f532ba6df94a4822f07bb9bdf375fc745b.exe

pid process

1948 4190ee00a01fd7d6693ae933c9bd37f532ba6df94a4822f07bb9bdf375fc745b.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

4190ee00a01fd7d6693ae933c9bd37f532ba6df94a4822f07bb9bdf375fc745b.exe

pid	process
1948	4190ee00a01fd7d6693ae933c9bd37f532ba6df94a4822f07bb9bdf375fc745b.exe
1948	4190ee00a01fd7d6693ae933c9bd37f532ba6df94a4822f07bb9bdf375fc745b.exe
1948	4190ee00a01fd7d6693ae933c9bd37f532ba6df94a4822f07bb9bdf375fc745b.exe
1948	4190ee00a01fd7d6693ae933c9bd37f532ba6df94a4822f07bb9bdf375fc745b.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

4190ee00a01fd7d6693ae933c9bd37f532ba6df94a4822f07bb9bdf375fc745b.exe

pid	process
1948	4190ee00a01fd7d6693ae933c9bd37f532ba6df94a4822f07bb9bdf375fc745b.exe
1948	4190ee00a01fd7d6693ae933c9bd37f532ba6df94a4822f07bb9bdf375fc745b.exe
1948	4190ee00a01fd7d6693ae933c9bd37f532ba6df94a4822f07bb9bdf375fc745b.exe

C:\Users\Admin\AppData\Local\Temp\4190ee00a01fd7d6693ae933c9bd37f532ba6df94a4822f07bb9bdf375fc745b.exe
"C:\Users\Admin\AppData\Local\Temp\4190ee00a01fd7d6693ae933c9bd37f532ba6df94a4822f07bb9bdf375fc745b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1948

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\config.ini
Filesize
24B

MD5
a0f6486d1b349fb7b92ec16b04ad593a

SHA1
078c3473deb7e7e6f1f8b1d83bb6721476f40397

SHA256
dc015ed4e48c96901f5e44d108dc6ab05bc5eef1f224a856a58ebb06e5e62f14

SHA512
c2648ca193e236adede8579a7d2f785399d758a4d5b98b430d3eeb5d60d6dded01361805f116b57c798698b022d460e0576b5b32b74f089d1c2bc51cbde99c77

Download Submit
memory/1948-54-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/1948-55-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/1948-56-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/1948-63-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/1948-64-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1948-69-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download