b72fae8f4c5d85e827ee1c517ab2f583ec674a872b8898888caa6949dc2bf60d

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20-08-2023 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b72fae8f4c5d85e827ee1c517ab2f583ec674a872b8898888caa6949dc2bf60d.exe
Size

39KB
MD5

799bdd45353909cab3fbceb8052ea7cf
SHA1

af91eb2b3ca286a5b9f0a9835c9113cd69614cb9
SHA256

b72fae8f4c5d85e827ee1c517ab2f583ec674a872b8898888caa6949dc2bf60d
SHA512

64331f66aa0b0f4c52a3624f02285875cc0ed0557229d57a729a4b0ad5d2665870ef6b80da0cb519c01653701edf72e34d7e862199ef0cebdbe134f0214808f2
SSDEEP

768:Z7ra/Tl+hs3E/jU0dugZ0T2Xtz+lHQW40Zz0D3jHUpi1GouKJRnSrh:U/T2X/jN2vxZz0DTHUpoudrh

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2176	Un_A.exe

Loads dropped DLL 1 IoCs

pid	Process
1696	b72fae8f4c5d85e827ee1c517ab2f583ec674a872b8898888caa6949dc2bf60d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2176	Un_A.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2176	1696	b72fae8f4c5d85e827ee1c517ab2f583ec674a872b8898888caa6949dc2bf60d.exe	28
PID 1696 wrote to memory of 2176	1696	b72fae8f4c5d85e827ee1c517ab2f583ec674a872b8898888caa6949dc2bf60d.exe	28
PID 1696 wrote to memory of 2176	1696	b72fae8f4c5d85e827ee1c517ab2f583ec674a872b8898888caa6949dc2bf60d.exe	28
PID 1696 wrote to memory of 2176	1696	b72fae8f4c5d85e827ee1c517ab2f583ec674a872b8898888caa6949dc2bf60d.exe	28

C:\Users\Admin\AppData\Local\Temp\b72fae8f4c5d85e827ee1c517ab2f583ec674a872b8898888caa6949dc2bf60d.exe
"C:\Users\Admin\AppData\Local\Temp\b72fae8f4c5d85e827ee1c517ab2f583ec674a872b8898888caa6949dc2bf60d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
39KB

MD5
799bdd45353909cab3fbceb8052ea7cf

SHA1
af91eb2b3ca286a5b9f0a9835c9113cd69614cb9

SHA256
b72fae8f4c5d85e827ee1c517ab2f583ec674a872b8898888caa6949dc2bf60d

SHA512
64331f66aa0b0f4c52a3624f02285875cc0ed0557229d57a729a4b0ad5d2665870ef6b80da0cb519c01653701edf72e34d7e862199ef0cebdbe134f0214808f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
39KB

MD5
799bdd45353909cab3fbceb8052ea7cf

SHA1
af91eb2b3ca286a5b9f0a9835c9113cd69614cb9

SHA256
b72fae8f4c5d85e827ee1c517ab2f583ec674a872b8898888caa6949dc2bf60d

SHA512
64331f66aa0b0f4c52a3624f02285875cc0ed0557229d57a729a4b0ad5d2665870ef6b80da0cb519c01653701edf72e34d7e862199ef0cebdbe134f0214808f2

Download Submit
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
39KB

MD5
799bdd45353909cab3fbceb8052ea7cf

SHA1
af91eb2b3ca286a5b9f0a9835c9113cd69614cb9

SHA256
b72fae8f4c5d85e827ee1c517ab2f583ec674a872b8898888caa6949dc2bf60d

SHA512
64331f66aa0b0f4c52a3624f02285875cc0ed0557229d57a729a4b0ad5d2665870ef6b80da0cb519c01653701edf72e34d7e862199ef0cebdbe134f0214808f2

Download Submit