df898ff67412c937511152fe4d52554f2869e6e530fe43d82de0160bb779dec7

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
24/07/2023, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

WPT810v09b0001.exe
Size

514KB
MD5

5353c4d7349939582378deb3e766f93d
SHA1

66e12e7a076e3da2abffa58924da5829dfedb4c0
SHA256

df898ff67412c937511152fe4d52554f2869e6e530fe43d82de0160bb779dec7
SHA512

54a30f1423d5671f312fb3023c8593c5ccfbcfd97cb0bcd305d77191352cca160d89caa549047d8426b87d83b0502ca465bb43cb23a5ac5eb191fd4948374d7d
SSDEEP

12288:Z3Mjhv8888888888888W88888888888lx4jn3bVNyRvh6QoqJh5+B+98LApia58v:dMjhKxyiWQpJh5n98LAoa58h5j

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2252	WPT810v09b0001.tmp

Loads dropped DLL 3 IoCs

pid	Process
932	WPT810v09b0001.exe
2252	WPT810v09b0001.tmp
2252	WPT810v09b0001.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2252	WPT810v09b0001.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 2252	932	WPT810v09b0001.exe	28
PID 932 wrote to memory of 2252	932	WPT810v09b0001.exe	28
PID 932 wrote to memory of 2252	932	WPT810v09b0001.exe	28
PID 932 wrote to memory of 2252	932	WPT810v09b0001.exe	28
PID 932 wrote to memory of 2252	932	WPT810v09b0001.exe	28
PID 932 wrote to memory of 2252	932	WPT810v09b0001.exe	28
PID 932 wrote to memory of 2252	932	WPT810v09b0001.exe	28

C:\Users\Admin\AppData\Local\Temp\WPT810v09b0001.exe
"C:\Users\Admin\AppData\Local\Temp\WPT810v09b0001.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Local\Temp\is-LDTQN.tmp\WPT810v09b0001.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-LDTQN.tmp\WPT810v09b0001.tmp" /SL5="$80120,148369,140800,C:\Users\Admin\AppData\Local\Temp\WPT810v09b0001.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-LDTQN.tmp\WPT810v09b0001.tmp

Filesize
1.1MB

MD5
394289faec0a43faea574588cb367018

SHA1
b02982a816782c3c16ad5a321dce0a79cab124a2

SHA256
89c8d27247ff86f189ebba01e27c47daa184a04c5f002130f9d336ca80d71202

SHA512
e99977ed9b3ea6607d347fe3e339cff40e70166db6a93443046cb7e0bc2a6f7c598503a55030f7d9ae0e8ede8b706bb4bd682bbdadf215641247b96bae0d09f4

Download Submit
\Users\Admin\AppData\Local\Temp\is-LDTQN.tmp\WPT810v09b0001.tmp

Filesize
1.1MB

MD5
394289faec0a43faea574588cb367018

SHA1
b02982a816782c3c16ad5a321dce0a79cab124a2

SHA256
89c8d27247ff86f189ebba01e27c47daa184a04c5f002130f9d336ca80d71202

SHA512
e99977ed9b3ea6607d347fe3e339cff40e70166db6a93443046cb7e0bc2a6f7c598503a55030f7d9ae0e8ede8b706bb4bd682bbdadf215641247b96bae0d09f4

Download Submit
\Users\Admin\AppData\Local\Temp\is-RFVF2.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-RFVF2.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/932-54-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/932-68-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2252-61-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2252-70-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2252-71-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads