b32a3a86c30974f1307ac3204e6bf9ba6f2880d9a09482a6bd2e7c60a8c98c9e

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
10/08/2023, 06:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a449aa3971e54d072641e91c37037308.exe
Size 2.7MB
Sample230810-g7rn6aae82
SHA256 b32a3a86c30974f1307ac3204e6bf9ba6f2880d9a09482a6bd2e7c60a8c98c9e
MD5 a449aa3971e54d072641e91c37037308
SHA1 aa526e650ae821f599eda9d53fb8b363d141f430
SHA512 5e4daf1a44dfc937302a82849deb08eecb3464959837c590ec966ccfd30dfeafbe88f1772f57121524763b770988a3ebcacf45fcefdcb1bcde9b35fd3a91e551
SSDEEP 49152:2WhlHLBfJXAE9mjdl5xzir8/nGnH0HS1FjCkBqYl27H2C74JaDEqfnmOQZokyUbC:2WhlrBfKE2dlDirECHlTjCkFl2T2C7Tv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
2672	rundll32.exe
2672	rundll32.exe
2672	rundll32.exe
2672	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2480	1796	a449aa3971e54d072641e91c37037308.exe	28
PID 1796 wrote to memory of 2480	1796	a449aa3971e54d072641e91c37037308.exe	28
PID 1796 wrote to memory of 2480	1796	a449aa3971e54d072641e91c37037308.exe	28
PID 1796 wrote to memory of 2480	1796	a449aa3971e54d072641e91c37037308.exe	28
PID 2480 wrote to memory of 2672	2480	control.exe	29
PID 2480 wrote to memory of 2672	2480	control.exe	29
PID 2480 wrote to memory of 2672	2480	control.exe	29
PID 2480 wrote to memory of 2672	2480	control.exe	29
PID 2480 wrote to memory of 2672	2480	control.exe	29
PID 2480 wrote to memory of 2672	2480	control.exe	29
PID 2480 wrote to memory of 2672	2480	control.exe	29
PID 2672 wrote to memory of 2132	2672	rundll32.exe	32
PID 2672 wrote to memory of 2132	2672	rundll32.exe	32
PID 2672 wrote to memory of 2132	2672	rundll32.exe	32
PID 2672 wrote to memory of 2132	2672	rundll32.exe	32
PID 2132 wrote to memory of 2860	2132	RunDll32.exe	33
PID 2132 wrote to memory of 2860	2132	RunDll32.exe	33
PID 2132 wrote to memory of 2860	2132	RunDll32.exe	33
PID 2132 wrote to memory of 2860	2132	RunDll32.exe	33
PID 2132 wrote to memory of 2860	2132	RunDll32.exe	33
PID 2132 wrote to memory of 2860	2132	RunDll32.exe	33
PID 2132 wrote to memory of 2860	2132	RunDll32.exe	33

C:\Users\Admin\AppData\Local\Temp\a449aa3971e54d072641e91c37037308.exe
"C:\Users\Admin\AppData\Local\Temp\a449aa3971e54d072641e91c37037308.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\YVY6jR.Cpl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\YVY6jR.Cpl",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\YVY6jR.Cpl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2132
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\YVY6jR.Cpl",
        5⤵
        Loads dropped DLL
        
        PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YVY6jR.Cpl

Path C:\Users\Admin\AppData\Local\Temp\YVY6jR.Cpl
Size 2.3MB
SHA256 190c520adbe98aa00bd7b7b1ee58ab1a5b0529a3c1743ee7b1f9667c1a0d264c
MD5 96400b560248368ba579ffc77e67773a
SHA1 29a4ff2a0395bcacbd1cdc05f69bb24837133258
SHA512 a83346bdb768d49edf8172b764aaf84db563c2d0a534edd593c1dec981e9a8c5234b78fbf74260ca224c09d2e65f0e1d9dc1136d2d16dd41a747e6ca87247ab8
SSDEEP 49152:D4ytAK2SkUDPyDRVxYM+bLM2VUmnmZhpSmxPEczSQf+6pb+8qvU:OK2q+RAXciUrZhpryiSQfjqvU
MD5 SHA1 SHA512 SSDEEP

Submit Download

yvY6jR.cpl

Path \Users\Admin\AppData\Local\Temp\yvY6jR.cpl
Size 2.3MB
SHA256 190c520adbe98aa00bd7b7b1ee58ab1a5b0529a3c1743ee7b1f9667c1a0d264c
MD5 96400b560248368ba579ffc77e67773a
SHA1 29a4ff2a0395bcacbd1cdc05f69bb24837133258
SHA512 a83346bdb768d49edf8172b764aaf84db563c2d0a534edd593c1dec981e9a8c5234b78fbf74260ca224c09d2e65f0e1d9dc1136d2d16dd41a747e6ca87247ab8
SSDEEP 49152:D4ytAK2SkUDPyDRVxYM+bLM2VUmnmZhpSmxPEczSQf+6pb+8qvU:OK2q+RAXciUrZhpryiSQfjqvU
MD5 SHA1 SHA512 SSDEEP

Submit Download

yvY6jR.cpl

Path \Users\Admin\AppData\Local\Temp\yvY6jR.cpl
Size 2.3MB
SHA256 190c520adbe98aa00bd7b7b1ee58ab1a5b0529a3c1743ee7b1f9667c1a0d264c
MD5 96400b560248368ba579ffc77e67773a
SHA1 29a4ff2a0395bcacbd1cdc05f69bb24837133258
SHA512 a83346bdb768d49edf8172b764aaf84db563c2d0a534edd593c1dec981e9a8c5234b78fbf74260ca224c09d2e65f0e1d9dc1136d2d16dd41a747e6ca87247ab8
SSDEEP 49152:D4ytAK2SkUDPyDRVxYM+bLM2VUmnmZhpSmxPEczSQf+6pb+8qvU:OK2q+RAXciUrZhpryiSQfjqvU
MD5 SHA1 SHA512 SSDEEP

Submit Download

yvY6jR.cpl

Path \Users\Admin\AppData\Local\Temp\yvY6jR.cpl
Size 2.3MB
SHA256 190c520adbe98aa00bd7b7b1ee58ab1a5b0529a3c1743ee7b1f9667c1a0d264c
MD5 96400b560248368ba579ffc77e67773a
SHA1 29a4ff2a0395bcacbd1cdc05f69bb24837133258
SHA512 a83346bdb768d49edf8172b764aaf84db563c2d0a534edd593c1dec981e9a8c5234b78fbf74260ca224c09d2e65f0e1d9dc1136d2d16dd41a747e6ca87247ab8
SSDEEP 49152:D4ytAK2SkUDPyDRVxYM+bLM2VUmnmZhpSmxPEczSQf+6pb+8qvU:OK2q+RAXciUrZhpryiSQfjqvU
MD5 SHA1 SHA512 SSDEEP

Submit Download

yvY6jR.cpl

Path \Users\Admin\AppData\Local\Temp\yvY6jR.cpl
Size 2.3MB
SHA256 190c520adbe98aa00bd7b7b1ee58ab1a5b0529a3c1743ee7b1f9667c1a0d264c
MD5 96400b560248368ba579ffc77e67773a
SHA1 29a4ff2a0395bcacbd1cdc05f69bb24837133258
SHA512 a83346bdb768d49edf8172b764aaf84db563c2d0a534edd593c1dec981e9a8c5234b78fbf74260ca224c09d2e65f0e1d9dc1136d2d16dd41a747e6ca87247ab8
SSDEEP 49152:D4ytAK2SkUDPyDRVxYM+bLM2VUmnmZhpSmxPEczSQf+6pb+8qvU:OK2q+RAXciUrZhpryiSQfjqvU
MD5 SHA1 SHA512 SSDEEP

Submit Download

yvY6jR.cpl

Path \Users\Admin\AppData\Local\Temp\yvY6jR.cpl
Size 2.3MB
SHA256 190c520adbe98aa00bd7b7b1ee58ab1a5b0529a3c1743ee7b1f9667c1a0d264c
MD5 96400b560248368ba579ffc77e67773a
SHA1 29a4ff2a0395bcacbd1cdc05f69bb24837133258
SHA512 a83346bdb768d49edf8172b764aaf84db563c2d0a534edd593c1dec981e9a8c5234b78fbf74260ca224c09d2e65f0e1d9dc1136d2d16dd41a747e6ca87247ab8
SSDEEP 49152:D4ytAK2SkUDPyDRVxYM+bLM2VUmnmZhpSmxPEczSQf+6pb+8qvU:OK2q+RAXciUrZhpryiSQfjqvU
MD5 SHA1 SHA512 SSDEEP

Submit Download

yvY6jR.cpl

Path \Users\Admin\AppData\Local\Temp\yvY6jR.cpl
Size 2.3MB
SHA256 190c520adbe98aa00bd7b7b1ee58ab1a5b0529a3c1743ee7b1f9667c1a0d264c
MD5 96400b560248368ba579ffc77e67773a
SHA1 29a4ff2a0395bcacbd1cdc05f69bb24837133258
SHA512 a83346bdb768d49edf8172b764aaf84db563c2d0a534edd593c1dec981e9a8c5234b78fbf74260ca224c09d2e65f0e1d9dc1136d2d16dd41a747e6ca87247ab8
SSDEEP 49152:D4ytAK2SkUDPyDRVxYM+bLM2VUmnmZhpSmxPEczSQf+6pb+8qvU:OK2q+RAXciUrZhpryiSQfjqvU
MD5 SHA1 SHA512 SSDEEP

Submit Download

yvY6jR.cpl

Path \Users\Admin\AppData\Local\Temp\yvY6jR.cpl
Size 2.3MB
SHA256 190c520adbe98aa00bd7b7b1ee58ab1a5b0529a3c1743ee7b1f9667c1a0d264c
MD5 96400b560248368ba579ffc77e67773a
SHA1 29a4ff2a0395bcacbd1cdc05f69bb24837133258
SHA512 a83346bdb768d49edf8172b764aaf84db563c2d0a534edd593c1dec981e9a8c5234b78fbf74260ca224c09d2e65f0e1d9dc1136d2d16dd41a747e6ca87247ab8
SSDEEP 49152:D4ytAK2SkUDPyDRVxYM+bLM2VUmnmZhpSmxPEczSQf+6pb+8qvU:OK2q+RAXciUrZhpryiSQfjqvU
MD5 SHA1 SHA512 SSDEEP

Submit Download

yvY6jR.cpl

Path \Users\Admin\AppData\Local\Temp\yvY6jR.cpl
Size 2.3MB
SHA256 190c520adbe98aa00bd7b7b1ee58ab1a5b0529a3c1743ee7b1f9667c1a0d264c
MD5 96400b560248368ba579ffc77e67773a
SHA1 29a4ff2a0395bcacbd1cdc05f69bb24837133258
SHA512 a83346bdb768d49edf8172b764aaf84db563c2d0a534edd593c1dec981e9a8c5234b78fbf74260ca224c09d2e65f0e1d9dc1136d2d16dd41a747e6ca87247ab8
SSDEEP 49152:D4ytAK2SkUDPyDRVxYM+bLM2VUmnmZhpSmxPEczSQf+6pb+8qvU:OK2q+RAXciUrZhpryiSQfjqvU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2672-61-0x0000000002350000-0x0000000002593000-memory.dmp

Download

memory/2672-70-0x0000000002A00000-0x0000000002AE4000-memory.dmp

Download

memory/2672-71-0x0000000002A00000-0x0000000002AE4000-memory.dmp

Download

memory/2672-67-0x0000000002A00000-0x0000000002AE4000-memory.dmp

Download

memory/2672-66-0x0000000002900000-0x00000000029FC000-memory.dmp

Download

memory/2672-62-0x00000000001C0000-0x00000000001C6000-memory.dmp

Download

memory/2672-63-0x0000000002350000-0x0000000002593000-memory.dmp

Download

memory/2860-76-0x0000000002320000-0x0000000002563000-memory.dmp

Download

memory/2860-77-0x00000000001B0000-0x00000000001B6000-memory.dmp

Download

memory/2860-78-0x0000000002320000-0x0000000002563000-memory.dmp

Download

memory/2860-82-0x00000000028D0000-0x00000000029CC000-memory.dmp

Download

memory/2860-83-0x00000000029D0000-0x0000000002AB4000-memory.dmp

Download

memory/2860-86-0x00000000029D0000-0x0000000002AB4000-memory.dmp

Download

memory/2860-87-0x00000000029D0000-0x0000000002AB4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads