1e627d15d8bf07a459b3e1773842c06976127c1557210b94fd5daea7df32c3ba

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
10-07-2023 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce8696b78c0dc6exeexeexeex.exe
Size

36KB
MD5

ce8696b78c0dc602d2814fd3ac8fd66f
SHA1

f3e8f40582e94f519d0198148490ca7584a24f15
SHA256

1e627d15d8bf07a459b3e1773842c06976127c1557210b94fd5daea7df32c3ba
SHA512

d01eb7bfb66668333de541be519383f834cf8be06b3aede0d8ba708b063e346e6f516abef59101bd650a20565146aefc1997dede091be63a48bd2d4427609c36
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf6XT+72Dx47xZ:bgX4zYcgTEu6QOaryfjqDlC76KP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2360	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2088	ce8696b78c0dc6exeexeexeex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2360	2088	ce8696b78c0dc6exeexeexeex.exe	29
PID 2088 wrote to memory of 2360	2088	ce8696b78c0dc6exeexeexeex.exe	29
PID 2088 wrote to memory of 2360	2088	ce8696b78c0dc6exeexeexeex.exe	29
PID 2088 wrote to memory of 2360	2088	ce8696b78c0dc6exeexeexeex.exe	29

C:\Users\Admin\AppData\Local\Temp\ce8696b78c0dc6exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\ce8696b78c0dc6exeexeexeex.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
36KB

MD5
23983f7f5e380b4b17164d055d6fc999

SHA1
f9963fbeeb9878674a89c8472e375d7cec660011

SHA256
9ec9e03da97e42de2ff94da8929badc7c7fa4049d2734a3f3c737a6aa1e28d28

SHA512
42c0ad818182ed3c82b957b625429ff359655f15c79269d875892931fd357dae49db1068a5809e63040f6783db67b4a72f021b1a75ced052f7db5cc52150bd33

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
36KB

MD5
23983f7f5e380b4b17164d055d6fc999

SHA1
f9963fbeeb9878674a89c8472e375d7cec660011

SHA256
9ec9e03da97e42de2ff94da8929badc7c7fa4049d2734a3f3c737a6aa1e28d28

SHA512
42c0ad818182ed3c82b957b625429ff359655f15c79269d875892931fd357dae49db1068a5809e63040f6783db67b4a72f021b1a75ced052f7db5cc52150bd33

Download Submit
\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
36KB

MD5
23983f7f5e380b4b17164d055d6fc999

SHA1
f9963fbeeb9878674a89c8472e375d7cec660011

SHA256
9ec9e03da97e42de2ff94da8929badc7c7fa4049d2734a3f3c737a6aa1e28d28

SHA512
42c0ad818182ed3c82b957b625429ff359655f15c79269d875892931fd357dae49db1068a5809e63040f6783db67b4a72f021b1a75ced052f7db5cc52150bd33

Download Submit
memory/2088-54-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2088-55-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2360-68-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download