31fcc1a7c79fa0e760d81e479154824551be394658821275380c9fc45343ae22

Analysis

max time kernel
36s
max time network
17s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13-08-2023 18:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fban4.exe
Size

796KB
MD5

7c813b54d429d4b71aca35778bca6d5c
SHA1

2dc6d1caab9825998bb735c7fdfef0ba4623a436
SHA256

5ceac115340684b175646a247d2eacdefaa695b040985fcf4de3fa19aa15c106
SHA512

bd391be9e4ff65e175daec2fbbeae06436f48fded823589f6f64a7cd5ab3a5079909c21f0cb7281b0ce1bca2554670810fb5d900a98a09f1694b00a989386fdc
SSDEEP

12288:FYX//nvg7tc+q6y6yLqskH1OjjgUeZ537r3vxFxAqzeJ0im:KPPvE6Z6y6QqskH1Ofgd5rr3vxFxAqz

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

filename.exe

pid process

2992 filename.exe
Loads dropped DLL 2 IoCs

Processes:

WScript.exe

pid process

2440 WScript.exe
2440 WScript.exe

pid	process
2992	filename.exe

pid	process
2440	WScript.exe
2440	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WScript.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Registry Key Name = "C:\\Users\\Admin\\AppData\\Local\\Temp\\subfolder\\filename.vbs"	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

fban4.exefilename.exe

pid process

2580 fban4.exe
2992 filename.exe

pid	process
2580	fban4.exe
2992	filename.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fban4.exeWScript.exe

description	pid	process	target process
PID 2580 wrote to memory of 2440	2580	fban4.exe	WScript.exe
PID 2580 wrote to memory of 2440	2580	fban4.exe	WScript.exe
PID 2580 wrote to memory of 2440	2580	fban4.exe	WScript.exe
PID 2580 wrote to memory of 2440	2580	fban4.exe	WScript.exe
PID 2440 wrote to memory of 2992	2440	WScript.exe	filename.exe
PID 2440 wrote to memory of 2992	2440	WScript.exe	filename.exe
PID 2440 wrote to memory of 2992	2440	WScript.exe	filename.exe
PID 2440 wrote to memory of 2992	2440	WScript.exe	filename.exe

C:\Users\Admin\AppData\Local\Temp\fban4.exe
"C:\Users\Admin\AppData\Local\Temp\fban4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\subfolder\filename.vbs"
2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2440

C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exe
"C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2992

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exe
Filesize
796KB

MD5
b71a202427c3900cf14b4f0226883074

SHA1
a44ccbf7f1f59986075dad8b31b11ba69c12e00c

SHA256
c8be7b87eaf410f1eb7de57f7050f9435103b9a07a1e6579cf606ce4b868bada

SHA512
9b5f826fa0c4872d98409a66704d279e55931897853a73b9737e8acd8f2b368ba538fd0ec9844911ca1eebe9afb43402f13544db95c60ff72aa98ab2bff3bdb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exe
Filesize
796KB

MD5
b71a202427c3900cf14b4f0226883074

SHA1
a44ccbf7f1f59986075dad8b31b11ba69c12e00c

SHA256
c8be7b87eaf410f1eb7de57f7050f9435103b9a07a1e6579cf606ce4b868bada

SHA512
9b5f826fa0c4872d98409a66704d279e55931897853a73b9737e8acd8f2b368ba538fd0ec9844911ca1eebe9afb43402f13544db95c60ff72aa98ab2bff3bdb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\subfolder\filename.vbs
Filesize
1024B

MD5
61303679134d10e8f1f35236fec661e6

SHA1
ed31726523d21be75c47e699eec4b76aeaa376d5

SHA256
047c78d7dbb5709dc8eee29b69d2a42aebe9249723105a56b8689c4657cb5331

SHA512
8fe11c1e624fbbc600f0402514b67f1b61c5123eba826bb50113858b96f283792cc9defdf1aa5c101c64e8ef65c0dd9ed6032debcb6f94dcbf8fcde90f2c3610

Download Submit
\Users\Admin\AppData\Local\Temp\subfolder\filename.exe
Filesize
796KB

MD5
b71a202427c3900cf14b4f0226883074

SHA1
a44ccbf7f1f59986075dad8b31b11ba69c12e00c

SHA256
c8be7b87eaf410f1eb7de57f7050f9435103b9a07a1e6579cf606ce4b868bada

SHA512
9b5f826fa0c4872d98409a66704d279e55931897853a73b9737e8acd8f2b368ba538fd0ec9844911ca1eebe9afb43402f13544db95c60ff72aa98ab2bff3bdb1

Download Submit
\Users\Admin\AppData\Local\Temp\subfolder\filename.exe
Filesize
796KB

MD5
b71a202427c3900cf14b4f0226883074

SHA1
a44ccbf7f1f59986075dad8b31b11ba69c12e00c

SHA256
c8be7b87eaf410f1eb7de57f7050f9435103b9a07a1e6579cf606ce4b868bada

SHA512
9b5f826fa0c4872d98409a66704d279e55931897853a73b9737e8acd8f2b368ba538fd0ec9844911ca1eebe9afb43402f13544db95c60ff72aa98ab2bff3bdb1

Download Submit
memory/2580-56-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2580-57-0x0000000077620000-0x00000000776F6000-memory.dmp

Filesize
856KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads