d175aa24c06accff348ccd15313fb983826cd7e6c87875a66ffc91c68083ae8a

Analysis

max time kernel
150s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-06-2023 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d175aa24c06accff348ccd15313fb983826cd7e6c87875a66ffc91c68083ae8a.exe
Size

739KB
MD5

a953ae698a1435515b00eb41be96384e
SHA1

635e5580eeb0507450e36f5d821adccac1cc2d2c
SHA256

d175aa24c06accff348ccd15313fb983826cd7e6c87875a66ffc91c68083ae8a
SHA512

a96a5491d01362d4d5031a32574664b0bc3dc813a9be9f2addf50ceab5aecc7ea3ee2ee25a1605ce94c5ef6238701a03549644ed326cf2b3f299fdf291c7ab65
SSDEEP

12288:fnF4QZth68k2PiEYlJE8ZblbK/uxMdSneGoRWf5geGzDNqcJ1CwoZznZeKk9tkxt:fnqQZtpk2Piv5zO/3dSnQWf55GfNqcTC

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

Processes:

d175aa24c06accff348ccd15313fb983826cd7e6c87875a66ffc91c68083ae8a.exe

description	ioc	process
File opened for modification	C:\Windows\ldsm.ini	d175aa24c06accff348ccd15313fb983826cd7e6c87875a66ffc91c68083ae8a.exe
File created	C:\Windows\ldsm.ini	d175aa24c06accff348ccd15313fb983826cd7e6c87875a66ffc91c68083ae8a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d175aa24c06accff348ccd15313fb983826cd7e6c87875a66ffc91c68083ae8a.exe

pid	process
1524	d175aa24c06accff348ccd15313fb983826cd7e6c87875a66ffc91c68083ae8a.exe
1524	d175aa24c06accff348ccd15313fb983826cd7e6c87875a66ffc91c68083ae8a.exe
1524	d175aa24c06accff348ccd15313fb983826cd7e6c87875a66ffc91c68083ae8a.exe
1524	d175aa24c06accff348ccd15313fb983826cd7e6c87875a66ffc91c68083ae8a.exe
1524	d175aa24c06accff348ccd15313fb983826cd7e6c87875a66ffc91c68083ae8a.exe

C:\Users\Admin\AppData\Local\Temp\d175aa24c06accff348ccd15313fb983826cd7e6c87875a66ffc91c68083ae8a.exe
"C:\Users\Admin\AppData\Local\Temp\d175aa24c06accff348ccd15313fb983826cd7e6c87875a66ffc91c68083ae8a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1524

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-54-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1524-56-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1524-55-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1524-59-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1524-61-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/1524-62-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1524-67-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1524-68-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1524-69-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1524-70-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1524-71-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1524-72-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1524-75-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/1524-78-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download