Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    24-08-2023 01:45

General

  • Target

    57ef91e4e7fb3b36bab175ab2841af15bdab50313141e39f23b7a5f8169908f3.exe

  • Size

    1.2MB

  • MD5

    85e7ba83121f4c6b55ad3447596d97cc

  • SHA1

    43ec44b701bbec540abdb4f01d8a9311053f952c

  • SHA256

    57ef91e4e7fb3b36bab175ab2841af15bdab50313141e39f23b7a5f8169908f3

  • SHA512

    8c4943f860166c64cb447cbc745cec9e23ea72aab75e89610a7da369a6adece39ac1fbd653603039a05d155610ca073202d944b6bda8b7e9ed6c90d32c25bbc0

  • SSDEEP

    12288:hzC1F/meN7YOxHf9JhqeKnq/sqn6pXTsKjt2V9J:VC1FmK7YOlfwhnKs+6pXTnp2V9

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1216
      • C:\Users\Admin\AppData\Local\Temp\57ef91e4e7fb3b36bab175ab2841af15bdab50313141e39f23b7a5f8169908f3.exe
        "C:\Users\Admin\AppData\Local\Temp\57ef91e4e7fb3b36bab175ab2841af15bdab50313141e39f23b7a5f8169908f3.exe"
        2⤵
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:1856
        • C:\Users\Admin\AppData\Local\Temp\57ef91e4e7fb3b36bab175ab2841af15bdab50313141e39f23b7a5f8169908f3.exe
          "C:\Users\Admin\AppData\Local\Temp\57ef91e4e7fb3b36bab175ab2841af15bdab50313141e39f23b7a5f8169908f3.exe"
          3⤵
            PID:888

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/888-4-0x00000000000B0000-0x00000000001E4E98-memory.dmp

        Filesize

        1.2MB

      • memory/1216-3-0x0000000002110000-0x0000000002111000-memory.dmp

        Filesize

        4KB

      • memory/1216-5-0x0000000002110000-0x0000000002111000-memory.dmp

        Filesize

        4KB

      • memory/1856-1-0x0000000000520000-0x0000000000655000-memory.dmp

        Filesize

        1.2MB

      • memory/1856-0-0x00000000000B0000-0x00000000001E4E98-memory.dmp

        Filesize

        1.2MB

      • memory/1856-6-0x00000000000B0000-0x00000000001E4E98-memory.dmp

        Filesize

        1.2MB