afc4b1b0760dafe8dab34c1bcc524cb5b0f7063b732b3380fcb51322084f13d1

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16-07-2023 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70e4d80c5ed539_JC.exe
Size

34KB
MD5

70e4d80c5ed539a0087011b711999ad8
SHA1

daa1581cefb1bb4243cedf90e5c566f4b47eba40
SHA256

afc4b1b0760dafe8dab34c1bcc524cb5b0f7063b732b3380fcb51322084f13d1
SHA512

44c44f03d799beca2e054c5d35993a60d544591695b2ca818cb400a5494cbb9d1302d396207065f64a11c5b4f93c261454ac9ae16d329096f19cc2780bffab82
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf6XT+0vJsghbu:bgX4zYcgTEu6QOaryfjqDlC6Jtbu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2284	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2560	70e4d80c5ed539_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2284	2560	70e4d80c5ed539_JC.exe	28
PID 2560 wrote to memory of 2284	2560	70e4d80c5ed539_JC.exe	28
PID 2560 wrote to memory of 2284	2560	70e4d80c5ed539_JC.exe	28
PID 2560 wrote to memory of 2284	2560	70e4d80c5ed539_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\70e4d80c5ed539_JC.exe
"C:\Users\Admin\AppData\Local\Temp\70e4d80c5ed539_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
35KB

MD5
a0aa35eae3bdceba14f5268c2ced748c

SHA1
13ab7447369a3e406d53e11a4b4f763381fdf287

SHA256
76e5716488e339b87f525116598afbed96298bc789515a2a4484a8383267c365

SHA512
42ec518a6545149ac845f0dc151bbc55abc08ef9478d0085afe9e1346f799a38331cb02400340002ae153c93ec6d5dd5f79d3e422a0d61049bcd20345c9f5edf

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
35KB

MD5
a0aa35eae3bdceba14f5268c2ced748c

SHA1
13ab7447369a3e406d53e11a4b4f763381fdf287

SHA256
76e5716488e339b87f525116598afbed96298bc789515a2a4484a8383267c365

SHA512
42ec518a6545149ac845f0dc151bbc55abc08ef9478d0085afe9e1346f799a38331cb02400340002ae153c93ec6d5dd5f79d3e422a0d61049bcd20345c9f5edf

Download Submit
\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
35KB

MD5
a0aa35eae3bdceba14f5268c2ced748c

SHA1
13ab7447369a3e406d53e11a4b4f763381fdf287

SHA256
76e5716488e339b87f525116598afbed96298bc789515a2a4484a8383267c365

SHA512
42ec518a6545149ac845f0dc151bbc55abc08ef9478d0085afe9e1346f799a38331cb02400340002ae153c93ec6d5dd5f79d3e422a0d61049bcd20345c9f5edf

Download Submit
memory/2284-70-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2284-69-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2560-54-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2560-56-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2560-55-0x0000000000570000-0x0000000000576000-memory.dmp

Filesize
24KB

Download