Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2023, 19:33

General

  • Target

    TF711147-CM.exe

  • Size

    593KB

  • MD5

    b1fad5b1225486fbefc01d8d984364c2

  • SHA1

    4ea620ca7e4a86844b89b20f3229ae7917909a34

  • SHA256

    937f4dc642813c7c6148e69841fa3111c68ace1e44d4690b1bd0074fc5ea6915

  • SHA512

    ac7895d920542ec58096b488eac8d166ae9a0d3c3e334c56276b3bf3dea04b959048cc38e374ec1d08e6acc838bae2dd52d1fc1f16d4e89112ec44cbe4c3da84

  • SSDEEP

    6144:SgORa6xKTuuuqjL7IMLeSaDsyZz8ZpgXenwCSJ1566NWZPu+b1GwXDD5I4CLyPbM:Sgm/SaTzl2wXOZzYwXDgyDQxZQ8IO

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TF711147-CM.exe
    "C:\Users\Admin\AppData\Local\Temp\TF711147-CM.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 540
      2⤵
      • Program crash
      PID:1608

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsd3803.tmp\System.dll

    Filesize

    12KB

    MD5

    6e55a6e7c3fdbd244042eb15cb1ec739

    SHA1

    070ea80e2192abc42f358d47b276990b5fa285a9

    SHA256

    acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

    SHA512

    2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

  • C:\Users\Admin\AppData\Local\Temp\nsd3803.tmp\nsExec.dll

    Filesize

    7KB

    MD5

    ec9c99216ef11cdd85965e78bc797d2c

    SHA1

    1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c

    SHA256

    c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df

    SHA512

    35ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1

  • \Users\Admin\AppData\Local\Temp\nsd3803.tmp\System.dll

    Filesize

    12KB

    MD5

    6e55a6e7c3fdbd244042eb15cb1ec739

    SHA1

    070ea80e2192abc42f358d47b276990b5fa285a9

    SHA256

    acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

    SHA512

    2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

  • \Users\Admin\AppData\Local\Temp\nsd3803.tmp\System.dll

    Filesize

    12KB

    MD5

    6e55a6e7c3fdbd244042eb15cb1ec739

    SHA1

    070ea80e2192abc42f358d47b276990b5fa285a9

    SHA256

    acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

    SHA512

    2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

  • \Users\Admin\AppData\Local\Temp\nsd3803.tmp\nsExec.dll

    Filesize

    7KB

    MD5

    ec9c99216ef11cdd85965e78bc797d2c

    SHA1

    1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c

    SHA256

    c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df

    SHA512

    35ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1

  • \Users\Admin\AppData\Local\Temp\nsd3803.tmp\nsExec.dll

    Filesize

    7KB

    MD5

    ec9c99216ef11cdd85965e78bc797d2c

    SHA1

    1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c

    SHA256

    c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df

    SHA512

    35ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1

  • \Users\Admin\AppData\Local\Temp\nsd3803.tmp\nsExec.dll

    Filesize

    7KB

    MD5

    ec9c99216ef11cdd85965e78bc797d2c

    SHA1

    1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c

    SHA256

    c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df

    SHA512

    35ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1

  • \Users\Admin\AppData\Local\Temp\nsd3803.tmp\nsExec.dll

    Filesize

    7KB

    MD5

    ec9c99216ef11cdd85965e78bc797d2c

    SHA1

    1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c

    SHA256

    c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df

    SHA512

    35ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1

  • \Users\Admin\AppData\Local\Temp\nsd3803.tmp\nsExec.dll

    Filesize

    7KB

    MD5

    ec9c99216ef11cdd85965e78bc797d2c

    SHA1

    1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c

    SHA256

    c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df

    SHA512

    35ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1

  • \Users\Admin\AppData\Local\Temp\nsd3803.tmp\nsExec.dll

    Filesize

    7KB

    MD5

    ec9c99216ef11cdd85965e78bc797d2c

    SHA1

    1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c

    SHA256

    c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df

    SHA512

    35ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1

  • memory/3068-38-0x00000000038E0000-0x0000000004A48000-memory.dmp

    Filesize

    17.4MB

  • memory/3068-39-0x00000000038E0000-0x0000000004A48000-memory.dmp

    Filesize

    17.4MB