1d0128fd3184a765076397dd308e51bbc578a3639cb9c08ab6b5c36704d772b4

Resubmissions

14-11-2023 17:31

231114-v3qg7acf42 10

14-11-2023 17:21

28-10-2023 19:29

24-10-2023 13:29

18-10-2023 12:04

07-09-2023 12:10

Analysis

max time kernel
31s
max time network
18s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-09-2023 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41edb742c1b69881657a48b74568410eb0dc7bfc9f540ab15c4ed0a665d97d45.exe
Size

49KB
MD5

67db842cfda0f13f7f9eb862f98b82ea
SHA1

96d4dc7b88edae9ca25f99a0bb635b50c90a72b0
SHA256

41edb742c1b69881657a48b74568410eb0dc7bfc9f540ab15c4ed0a665d97d45
SHA512

864aa524d7cfe156c3d5e44e7693243e78dba0b8a7974f0a7186e5c82f09025f74f693bb3378123d485f1c669a1ff6859064a1bb372e57d572a0e17fd98edb0e
SSDEEP

768:ljRGdM7TcGI0oDfkibwPi3xLrXdWBM6QQEUoaD0g9WXuekoD7j2wVUj6ZKl:ljUWI0+hwetdOvDz9Ilko/tUj6ZKl

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\braviax = "C:\\Windows\\system32\\braviax.exe"	41edb742c1b69881657a48b74568410eb0dc7bfc9f540ab15c4ed0a665d97d45.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows\CurrentVersion\Run\braviax = "C:\\Windows\\system32\\braviax.exe"	41edb742c1b69881657a48b74568410eb0dc7bfc9f540ab15c4ed0a665d97d45.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\braviax.exe	41edb742c1b69881657a48b74568410eb0dc7bfc9f540ab15c4ed0a665d97d45.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 1740	2144	41edb742c1b69881657a48b74568410eb0dc7bfc9f540ab15c4ed0a665d97d45.exe	28
PID 2144 wrote to memory of 1740	2144	41edb742c1b69881657a48b74568410eb0dc7bfc9f540ab15c4ed0a665d97d45.exe	28
PID 2144 wrote to memory of 1740	2144	41edb742c1b69881657a48b74568410eb0dc7bfc9f540ab15c4ed0a665d97d45.exe	28
PID 2144 wrote to memory of 1740	2144	41edb742c1b69881657a48b74568410eb0dc7bfc9f540ab15c4ed0a665d97d45.exe	28

C:\Users\Admin\AppData\Local\Temp\41edb742c1b69881657a48b74568410eb0dc7bfc9f540ab15c4ed0a665d97d45.exe
"C:\Users\Admin\AppData\Local\Temp\41edb742c1b69881657a48b74568410eb0dc7bfc9f540ab15c4ed0a665d97d45.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\delself.bat" "
  2⤵
  PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\delself.bat

Filesize
266B

MD5
33b9cf008c77e2989e3134c8fec47c7b

SHA1
be629a38917ba98e8096b83ee3e071397d4a188e

SHA256
20d4884193ce90177a76a9d9ed517ff22191a55084e04a2b7693e5473546f414

SHA512
5931338c7900c427c5882b52b5b02d97ae05dc2c5a2512fcb5a08bf9ed15a689127c95b9e3db07351e48c2a2a366798b4ab639d6395d206e12ddc58391c4a791

Download Submit
C:\Users\Admin\AppData\Local\Temp\delself.bat

Filesize
266B

MD5
33b9cf008c77e2989e3134c8fec47c7b

SHA1
be629a38917ba98e8096b83ee3e071397d4a188e

SHA256
20d4884193ce90177a76a9d9ed517ff22191a55084e04a2b7693e5473546f414

SHA512
5931338c7900c427c5882b52b5b02d97ae05dc2c5a2512fcb5a08bf9ed15a689127c95b9e3db07351e48c2a2a366798b4ab639d6395d206e12ddc58391c4a791

Download Submit
memory/2144-0-0x0000000000020000-0x000000000002C000-memory.dmp

Filesize
48KB

Download
memory/2144-11-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads