02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11

Analysis

max time kernel
148s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe
Size

1.2MB
MD5

596ebe8fe69fc0cb8935845fe913550f
SHA1

f39a2929bad8f89a357a5dc53ee5b49d61de3541
SHA256

02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11
SHA512

58230134aa8f796ae34628ff65a89ee4c17236ee725112b8a6883485f814582afdbffbf22799808cd2a819dc915d1596d45999bfa2df2afe15bde3369d0c09ec
SSDEEP

24576:GgZXoZUTVdt7KzkmTWLUSTMyyNdwMWxzN+wyuk7gAPTWMinCTd5hxIuRMFEoI:dvmqdTMnNdsEwyuk7j7WDCTTosMFrI

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2844	svchost.exe

Loads dropped DLL 4 IoCs

pid	Process
532	02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe
532	02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe
532	02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe
532	02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2844	svchost.exe
2844	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 2844	532	02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe	28
PID 532 wrote to memory of 2844	532	02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe	28
PID 532 wrote to memory of 2844	532	02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe	28
PID 532 wrote to memory of 2844	532	02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe	28

C:\Users\Admin\AppData\Local\Temp\02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe
"C:\Users\Admin\AppData\Local\Temp\02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:532
- C:\ProgramData\yeji\svchost.exe
  "C:\ProgramData\yeji\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\yeji\svchost.exe

Filesize
815KB

MD5
cca2156349a58b04703bd0b11d77438e

SHA1
ffb7ff724e517212f6e461b6ed91dd01cd9fd26c

SHA256
d9a1ca5ddf1fc668947479d5ec2a2d5cff7967ba81b814b6d5ca3cf9ad4ef3c8

SHA512
70d6abd4fbdb4f72f5ec2f771fa4049bf3ae314e9875ea0feff2024990622f7beb0ceeb8a160019587beed8db0c4afd0a47d44f9b275fb9f06399c42f9c8589a

Download Submit
C:\ProgramData\yeji\svchost.exe

Filesize
815KB

MD5
cca2156349a58b04703bd0b11d77438e

SHA1
ffb7ff724e517212f6e461b6ed91dd01cd9fd26c

SHA256
d9a1ca5ddf1fc668947479d5ec2a2d5cff7967ba81b814b6d5ca3cf9ad4ef3c8

SHA512
70d6abd4fbdb4f72f5ec2f771fa4049bf3ae314e9875ea0feff2024990622f7beb0ceeb8a160019587beed8db0c4afd0a47d44f9b275fb9f06399c42f9c8589a

Download Submit
C:\ProgramData\yeji\svchost.exe

Filesize
815KB

MD5
cca2156349a58b04703bd0b11d77438e

SHA1
ffb7ff724e517212f6e461b6ed91dd01cd9fd26c

SHA256
d9a1ca5ddf1fc668947479d5ec2a2d5cff7967ba81b814b6d5ca3cf9ad4ef3c8

SHA512
70d6abd4fbdb4f72f5ec2f771fa4049bf3ae314e9875ea0feff2024990622f7beb0ceeb8a160019587beed8db0c4afd0a47d44f9b275fb9f06399c42f9c8589a

Download Submit
\ProgramData\yeji\svchost.exe

Filesize
815KB

MD5
cca2156349a58b04703bd0b11d77438e

SHA1
ffb7ff724e517212f6e461b6ed91dd01cd9fd26c

SHA256
d9a1ca5ddf1fc668947479d5ec2a2d5cff7967ba81b814b6d5ca3cf9ad4ef3c8

SHA512
70d6abd4fbdb4f72f5ec2f771fa4049bf3ae314e9875ea0feff2024990622f7beb0ceeb8a160019587beed8db0c4afd0a47d44f9b275fb9f06399c42f9c8589a

Download Submit
\ProgramData\yeji\svchost.exe

Filesize
815KB

MD5
cca2156349a58b04703bd0b11d77438e

SHA1
ffb7ff724e517212f6e461b6ed91dd01cd9fd26c

SHA256
d9a1ca5ddf1fc668947479d5ec2a2d5cff7967ba81b814b6d5ca3cf9ad4ef3c8

SHA512
70d6abd4fbdb4f72f5ec2f771fa4049bf3ae314e9875ea0feff2024990622f7beb0ceeb8a160019587beed8db0c4afd0a47d44f9b275fb9f06399c42f9c8589a

Download Submit
\ProgramData\yeji\svchost.exe

Filesize
815KB

MD5
cca2156349a58b04703bd0b11d77438e

SHA1
ffb7ff724e517212f6e461b6ed91dd01cd9fd26c

SHA256
d9a1ca5ddf1fc668947479d5ec2a2d5cff7967ba81b814b6d5ca3cf9ad4ef3c8

SHA512
70d6abd4fbdb4f72f5ec2f771fa4049bf3ae314e9875ea0feff2024990622f7beb0ceeb8a160019587beed8db0c4afd0a47d44f9b275fb9f06399c42f9c8589a

Download Submit
\ProgramData\yeji\svchost.exe

Filesize
815KB

MD5
cca2156349a58b04703bd0b11d77438e

SHA1
ffb7ff724e517212f6e461b6ed91dd01cd9fd26c

SHA256
d9a1ca5ddf1fc668947479d5ec2a2d5cff7967ba81b814b6d5ca3cf9ad4ef3c8

SHA512
70d6abd4fbdb4f72f5ec2f771fa4049bf3ae314e9875ea0feff2024990622f7beb0ceeb8a160019587beed8db0c4afd0a47d44f9b275fb9f06399c42f9c8589a

Download Submit