Analysis

  • max time kernel
    122s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    29-07-2023 16:43

General

  • Target

  • Size

    31.4MB

  • MD5

    693ce587757ecfb4a2ad9a0b7ed69c46

  • SHA1

    f26ff05fd9e51040227f3c17c9a1859f184b3ffb

  • SHA256

    c67d53bf5609737cb35b19b696f229f0fbd513fbabfad33a3c93850a23ab1ea5

  • SHA512

    e1df3e3d96008ae38daf6f57cafdb41f1d53915d716e0c93e727f149254e56cfca4efb437be5819b6ce69956e8e36b50a69a2e769a36262e924da4e085a2ee8f

  • SSDEEP

    786432:fxJxyhzJySNqxsDM09U3lHyetJ60ak9Xw1v:1ytJPNq2DMzzO0ak9Xev

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    1⤵
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2596-54-0x00000000778A0000-0x00000000778A2000-memory.dmp

    Filesize

    8KB

  • memory/2596-56-0x00000000778A0000-0x00000000778A2000-memory.dmp

    Filesize

    8KB

  • memory/2596-59-0x00000000776F0000-0x0000000077899000-memory.dmp

    Filesize

    1.7MB

  • memory/2596-58-0x00000000778A0000-0x00000000778A2000-memory.dmp

    Filesize

    8KB

  • memory/2596-60-0x000000013F090000-0x000000014240C000-memory.dmp

    Filesize

    51.5MB

  • memory/2596-64-0x00000000776F0000-0x0000000077899000-memory.dmp

    Filesize

    1.7MB

  • memory/2596-65-0x00000000776F0000-0x0000000077899000-memory.dmp

    Filesize

    1.7MB