d34a31171bb2c40cc7d51b5a9090faee60fc2caee9672c0b287ae3f76e9c3d52

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/06/2023, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xmawCzphNPzm.exe
Size 481KB
Sample230616-yttp2age58
SHA256 d34a31171bb2c40cc7d51b5a9090faee60fc2caee9672c0b287ae3f76e9c3d52
MD5 0b6133d5b36cd98c3391f03ae97633d7
SHA1 7773a5b7e7780e93cb12b2d12a2baa98b96b1962
SHA512 c502c2f224235963ed379f88acc5964217e26c50bc25601e9d4ce09a602350609410e5ce978cbc65640cbf7485caf0d101cb02643008d25a37fb29d132be1821
SSDEEP 12288:fRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/Zf2cDU:fx7cyF2eSsewS8W47eZO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
952	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1324	xmawCzphNPzm.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 952	1324	xmawCzphNPzm.exe	29
PID 1324 wrote to memory of 952	1324	xmawCzphNPzm.exe	29
PID 1324 wrote to memory of 952	1324	xmawCzphNPzm.exe	29
PID 1324 wrote to memory of 952	1324	xmawCzphNPzm.exe	29

C:\Users\Admin\AppData\Local\Temp\xmawCzphNPzm.exe
"C:\Users\Admin\AppData\Local\Temp\xmawCzphNPzm.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vsgze.vbs"
  2⤵
  - Deletes itself
  PID:952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vsgze.vbs

Path C:\Users\Admin\AppData\Local\Temp\vsgze.vbs
Size 520B
SHA256 b76a7f043f88548a4c7d41cf2f34087673f958f8963ba29e293b5f13aa9e8875
MD5 094c9baaf83a53e0866ab8e53692c9f0
SHA1 cf1edf6eb3d9b1ac61355c346966a9a224155ec8
SHA512 306ce87c02659806650d1405826fa278a2b107889410a5fb2955e83e5c2809987f230c0a1c6ca044d878686804cb65d3df41751f6d0dba52f6f5e931827789ab
MD5 SHA1 SHA512

Submit Download