Analysis
-
max time kernel
131s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
18-08-2023 19:22
General
-
Target
21522be9ceffae83725a8dba8bc537bf8ec4e385ee84ca35ca5c3f157db0c678.exe
-
Size
12.4MB
-
MD5
7044915e733fda84650e589dac5ef95f
-
SHA1
6a5b6601b065898675cf65267c1d5e05ec5fb3c3
-
SHA256
21522be9ceffae83725a8dba8bc537bf8ec4e385ee84ca35ca5c3f157db0c678
-
SHA512
a62e2526e97cb9bbe6c041ee5c848e5a43a2380d83bec0db13450e50ea4b4fc8ab8eea12d953555efdfc16fc241227846d472bca9d1a2c223dec6f64b2844ca3
-
SSDEEP
393216:b/NlbXEOb4mYRKQo1KueMwEvCUy9oRbfbOGh:b/NljEOUmhQo1Kue/EvCLSDqGh
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\21522be9ceffae83725a8dba8bc537bf8ec4e385ee84ca35ca5c3f157db0c678.exe"C:\Users\Admin\AppData\Local\Temp\21522be9ceffae83725a8dba8bc537bf8ec4e385ee84ca35ca5c3f157db0c678.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\21522be9ceffae83725a8dba8bc537bf8ec4e385ee84ca35ca5c3f157db0c678\21522be9ceffae83725a8dba8bc537bf8ec4e385ee84ca35ca5c3f157db0c678.exeC:\21522be9ceffae83725a8dba8bc537bf8ec4e385ee84ca35ca5c3f157db0c678\21522be9ceffae83725a8dba8bc537bf8ec4e385ee84ca35ca5c3f157db0c678.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.4MB
MD57044915e733fda84650e589dac5ef95f
SHA16a5b6601b065898675cf65267c1d5e05ec5fb3c3
SHA25621522be9ceffae83725a8dba8bc537bf8ec4e385ee84ca35ca5c3f157db0c678
SHA512a62e2526e97cb9bbe6c041ee5c848e5a43a2380d83bec0db13450e50ea4b4fc8ab8eea12d953555efdfc16fc241227846d472bca9d1a2c223dec6f64b2844ca3
-
Filesize
12.4MB
MD57044915e733fda84650e589dac5ef95f
SHA16a5b6601b065898675cf65267c1d5e05ec5fb3c3
SHA25621522be9ceffae83725a8dba8bc537bf8ec4e385ee84ca35ca5c3f157db0c678
SHA512a62e2526e97cb9bbe6c041ee5c848e5a43a2380d83bec0db13450e50ea4b4fc8ab8eea12d953555efdfc16fc241227846d472bca9d1a2c223dec6f64b2844ca3
-
Filesize
18KB
MD505bd4fd84371753bba968efd931e9cc2
SHA1c905666190a47e11713f69f8a53e05bb66dc29ee
SHA2561907ed0d471956525516a15bce092e679902ecff9550c5e49ce7841f536f0176
SHA5129a935f55fc38c3381e2e28479360ba239e8c64c38b143b8371b7f39512c91a0416245f1eaa169b86206c782dfb83d081d969e0aff3ff3de32ce659d892a773aa
-
Filesize
67B
MD5225ed407f12376451a63e81feb899375
SHA138225422785cfb3a7b6524ee0211ae77497eb7ce
SHA256af27c07eee39a7acab578c93c65c788845f20ead230feb29e9bfe980843b7a1d
SHA5125f44aa66635d34242ecb05cc79bda33211b7e5479861dd486b88d78d5d2c9b4eb2a4fa0770c2db54c6222016a97d27da4f2e0855062a2825b7a4ddb8c0390a74
-
Filesize
102B
MD52ea600782f6d9cf9d05337d833f09dea
SHA13992be167faf9ffbc0a210017bc42f4e6ca6b8fa
SHA25619bb6670e02692762e07fe1e00a66f647ec3e2f91b2ee7ed2bf6c82c88607b32
SHA512bd91184619adf76411c4c8cc8f5b926b097f39a437be38e820d41df190dc39d34dc4522277a40bdeb3a1364c141b5145641283b8e2057c2cc54187ea2c13176e
-
Filesize
12.4MB
MD57044915e733fda84650e589dac5ef95f
SHA16a5b6601b065898675cf65267c1d5e05ec5fb3c3
SHA25621522be9ceffae83725a8dba8bc537bf8ec4e385ee84ca35ca5c3f157db0c678
SHA512a62e2526e97cb9bbe6c041ee5c848e5a43a2380d83bec0db13450e50ea4b4fc8ab8eea12d953555efdfc16fc241227846d472bca9d1a2c223dec6f64b2844ca3
-
Filesize
8.2MB
-
Filesize
12KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
4KB
-
Filesize
8.2MB
-
Filesize
12KB
-
Filesize
8.2MB
-
Filesize
12KB