dfe7e4fbd24d6da7c404715de7b21b19f7927fb49de8f96fa21361cc9900792f

Analysis

max time kernel
140s
max time network
145s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
14/07/2023, 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1480709182de36exe_JC.exe
Size

31KB
MD5

1480709182de36f73d7ff8728f93dee1
SHA1

76038ac4fbff695f9f50369dafb0ea33526bd96b
SHA256

dfe7e4fbd24d6da7c404715de7b21b19f7927fb49de8f96fa21361cc9900792f
SHA512

b4a4ca43f38c171f03c27be99dcfb1a2e0f5f46400b46636d2cf52a0d49d634a72cad195f2dbe6e4b5efa58df49d47c7d5dc704a440cb783f5dac6c70b8efc3b
SSDEEP

768:q0ZziOWwULueOSdE8tOOtEvwDpjeW00shO:q0zizzOSxMOtEvwDpj/0dhO

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1764	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2616	1480709182de36exe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 1764	2616	1480709182de36exe_JC.exe	28
PID 2616 wrote to memory of 1764	2616	1480709182de36exe_JC.exe	28
PID 2616 wrote to memory of 1764	2616	1480709182de36exe_JC.exe	28
PID 2616 wrote to memory of 1764	2616	1480709182de36exe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\1480709182de36exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\1480709182de36exe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
31KB

MD5
3a96597fdd0c015863a338cd61ffe784

SHA1
0e36a6554ac7c32800ad43bebffe782cf1b8d0b8

SHA256
211dabe3a88dfc1a176ad26251529e0812ba5d2ce4803d992020556fdb348d51

SHA512
7d8707d392e9caa1a94cf6a9c2ca054469841cc7f41976402376ca8fa2288709a51aaf2831039d5bcc5789f85f7ac364db5c07f4b8562d6431e04f7a28989c6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
31KB

MD5
3a96597fdd0c015863a338cd61ffe784

SHA1
0e36a6554ac7c32800ad43bebffe782cf1b8d0b8

SHA256
211dabe3a88dfc1a176ad26251529e0812ba5d2ce4803d992020556fdb348d51

SHA512
7d8707d392e9caa1a94cf6a9c2ca054469841cc7f41976402376ca8fa2288709a51aaf2831039d5bcc5789f85f7ac364db5c07f4b8562d6431e04f7a28989c6f

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
31KB

MD5
3a96597fdd0c015863a338cd61ffe784

SHA1
0e36a6554ac7c32800ad43bebffe782cf1b8d0b8

SHA256
211dabe3a88dfc1a176ad26251529e0812ba5d2ce4803d992020556fdb348d51

SHA512
7d8707d392e9caa1a94cf6a9c2ca054469841cc7f41976402376ca8fa2288709a51aaf2831039d5bcc5789f85f7ac364db5c07f4b8562d6431e04f7a28989c6f

Download Submit
memory/1764-70-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1764-73-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1764-80-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2616-54-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2616-55-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2616-56-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2616-57-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2616-69-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download