25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2023, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6.exe
Size

390KB
MD5

de738b39523e4454032ef45841cbeaf5
SHA1

41588f8944dd255c5c58511b593dc2decb45e784
SHA256

25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6
SHA512

3284f2a3bd48e3c89759b2b2521ef18be9e219f034e07cc41984b08b52c2b92e0abdeb8f48525e959c6c07a1d19a4437dab89fdf551fb8fcb66340d34eb805d3
SSDEEP

6144:zkZI35TvFdw7/QR+pAVIfPCd+86skDxRUpipiY5Cv6LvbcyyBjwnTx1w+0imHXtP:zh07/2+pAyPCLyfioLj7x1gimH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1552	25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4484	1552	WerFault.exe	82

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1600	25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6.exe
1600	25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6.exe
1552	25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6.exe
1552	25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1552	1600	25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6.exe	82
PID 1600 wrote to memory of 1552	1600	25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6.exe	82
PID 1600 wrote to memory of 1552	1600	25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6.exe	82

C:\Users\Admin\AppData\Local\Temp\25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6.exe
"C:\Users\Admin\AppData\Local\Temp\25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Public\Music\25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6.exe
  "C:\Users\Public\Music\25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 1284
    3⤵
    - Program crash
    PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1552 -ip 1552
1⤵
PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Music\25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6.exe

Filesize
390KB

MD5
de738b39523e4454032ef45841cbeaf5

SHA1
41588f8944dd255c5c58511b593dc2decb45e784

SHA256
25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6

SHA512
3284f2a3bd48e3c89759b2b2521ef18be9e219f034e07cc41984b08b52c2b92e0abdeb8f48525e959c6c07a1d19a4437dab89fdf551fb8fcb66340d34eb805d3

Download Submit
C:\Users\Public\Music\25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6.exe

Filesize
390KB

MD5
de738b39523e4454032ef45841cbeaf5

SHA1
41588f8944dd255c5c58511b593dc2decb45e784

SHA256
25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6

SHA512
3284f2a3bd48e3c89759b2b2521ef18be9e219f034e07cc41984b08b52c2b92e0abdeb8f48525e959c6c07a1d19a4437dab89fdf551fb8fcb66340d34eb805d3

Download Submit
C:\Users\Public\Music\25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6.exe

Filesize
390KB

MD5
de738b39523e4454032ef45841cbeaf5

SHA1
41588f8944dd255c5c58511b593dc2decb45e784

SHA256
25072d52a0c800115eddf698a9307915ca8c99048c2cd5648d8d547ed089ecc6

SHA512
3284f2a3bd48e3c89759b2b2521ef18be9e219f034e07cc41984b08b52c2b92e0abdeb8f48525e959c6c07a1d19a4437dab89fdf551fb8fcb66340d34eb805d3

Download Submit
memory/1552-12-0x0000000000630000-0x0000000000633000-memory.dmp

Filesize
12KB

Download
memory/1552-13-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/1552-15-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/1600-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/1600-1-0x00000000006D0000-0x00000000006D3000-memory.dmp

Filesize
12KB

Download
memory/1600-10-0x00000000006D0000-0x00000000006D3000-memory.dmp

Filesize
12KB

Download
memory/1600-9-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download