5772a29c962b28b0379d909bf7bec56e17812c0c4218995d09c786ea74c9b9b4

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/07/2023, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab24fbeb4c612exe_JC.exe
Size

35KB
MD5

eab24fbeb4c6120bf3e051b3be7c8a29
SHA1

7e5370eb6b823b3829f38b5b93a22b3e1b63e6ad
SHA256

5772a29c962b28b0379d909bf7bec56e17812c0c4218995d09c786ea74c9b9b4
SHA512

58b4c90b720283084752659ee437777b69f7c1d15fc29fa426813116e8318a5c01721617830e889c93f69acd7003f8781ee18fe4641886010711da1f5fd15672
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf6XT+0vJsg5b5U9:bgX4zYcgTEu6QOaryfjqDlC6JFbK9

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2536	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2216	eab24fbeb4c612exe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2536	2216	eab24fbeb4c612exe_JC.exe	28
PID 2216 wrote to memory of 2536	2216	eab24fbeb4c612exe_JC.exe	28
PID 2216 wrote to memory of 2536	2216	eab24fbeb4c612exe_JC.exe	28
PID 2216 wrote to memory of 2536	2216	eab24fbeb4c612exe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\eab24fbeb4c612exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\eab24fbeb4c612exe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
35KB

MD5
321ada052955a1c105c15303d6a45627

SHA1
1ac223224675a30b503732ecf5e768b23530dd95

SHA256
eb0dd03bcaafd1d67f1809a780a0818286791f99edfb2c14c3d6f26ef0ec5531

SHA512
72ae0eed51d6a1477cf9e5e9d9acd5a2cf3e461a60b737fed86813e4b5d192459a87e110268365bf6dd7e73d9ffb04cba16661e75a9abafaf2e66e593a60ffe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
35KB

MD5
321ada052955a1c105c15303d6a45627

SHA1
1ac223224675a30b503732ecf5e768b23530dd95

SHA256
eb0dd03bcaafd1d67f1809a780a0818286791f99edfb2c14c3d6f26ef0ec5531

SHA512
72ae0eed51d6a1477cf9e5e9d9acd5a2cf3e461a60b737fed86813e4b5d192459a87e110268365bf6dd7e73d9ffb04cba16661e75a9abafaf2e66e593a60ffe2

Download Submit
\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
35KB

MD5
321ada052955a1c105c15303d6a45627

SHA1
1ac223224675a30b503732ecf5e768b23530dd95

SHA256
eb0dd03bcaafd1d67f1809a780a0818286791f99edfb2c14c3d6f26ef0ec5531

SHA512
72ae0eed51d6a1477cf9e5e9d9acd5a2cf3e461a60b737fed86813e4b5d192459a87e110268365bf6dd7e73d9ffb04cba16661e75a9abafaf2e66e593a60ffe2

Download Submit
memory/2216-54-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2216-55-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2216-56-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2536-69-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2536-70-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download