Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2023 04:51
Behavioral task
behavioral1
Sample
fe207dcf0077114dd81acdf5da97f389cc1eaaa36bdff2dde02035d8994bd527.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fe207dcf0077114dd81acdf5da97f389cc1eaaa36bdff2dde02035d8994bd527.exe
Resource
win10v2004-20230220-en
General
-
Target
fe207dcf0077114dd81acdf5da97f389cc1eaaa36bdff2dde02035d8994bd527.exe
-
Size
4.2MB
-
MD5
377fbddda86714a8367b535544f003ec
-
SHA1
28567a96df9b0e84947b03f3889225d7e287919d
-
SHA256
fe207dcf0077114dd81acdf5da97f389cc1eaaa36bdff2dde02035d8994bd527
-
SHA512
ebd4a3afaf207a7c4c1e9e62539319564298f67e85f1eba53b1eb5d55bc6cea88f5da9de04f20c93b67251d0229b810e527688d6b805dd3003830e904e4cd4a3
-
SSDEEP
98304:brEaB7+7NB8dh8MPXAKkc8UrxuYYjZBsgh/D5PAtOW7:brESaJsh5PQUFu5BHXPA8Y
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
fe207dcf0077114dd81acdf5da97f389cc1eaaa36bdff2dde02035d8994bd527.exepid process 3808 fe207dcf0077114dd81acdf5da97f389cc1eaaa36bdff2dde02035d8994bd527.exe 3808 fe207dcf0077114dd81acdf5da97f389cc1eaaa36bdff2dde02035d8994bd527.exe 3808 fe207dcf0077114dd81acdf5da97f389cc1eaaa36bdff2dde02035d8994bd527.exe 3808 fe207dcf0077114dd81acdf5da97f389cc1eaaa36bdff2dde02035d8994bd527.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
fe207dcf0077114dd81acdf5da97f389cc1eaaa36bdff2dde02035d8994bd527.exepid process 3808 fe207dcf0077114dd81acdf5da97f389cc1eaaa36bdff2dde02035d8994bd527.exe 3808 fe207dcf0077114dd81acdf5da97f389cc1eaaa36bdff2dde02035d8994bd527.exe 3808 fe207dcf0077114dd81acdf5da97f389cc1eaaa36bdff2dde02035d8994bd527.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe207dcf0077114dd81acdf5da97f389cc1eaaa36bdff2dde02035d8994bd527.exe"C:\Users\Admin\AppData\Local\Temp\fe207dcf0077114dd81acdf5da97f389cc1eaaa36bdff2dde02035d8994bd527.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3808-133-0x0000000000400000-0x0000000001592000-memory.dmpFilesize
17.6MB
-
memory/3808-134-0x0000000000400000-0x0000000001592000-memory.dmpFilesize
17.6MB
-
memory/3808-135-0x0000000000400000-0x0000000001592000-memory.dmpFilesize
17.6MB
-
memory/3808-136-0x0000000000400000-0x0000000001592000-memory.dmpFilesize
17.6MB
-
memory/3808-137-0x0000000000400000-0x0000000001592000-memory.dmpFilesize
17.6MB
-
memory/3808-140-0x0000000003420000-0x0000000003421000-memory.dmpFilesize
4KB
-
memory/3808-143-0x0000000000400000-0x0000000001592000-memory.dmpFilesize
17.6MB
-
memory/3808-145-0x0000000000400000-0x0000000001592000-memory.dmpFilesize
17.6MB
-
memory/3808-146-0x0000000000400000-0x0000000001592000-memory.dmpFilesize
17.6MB