Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/09/2023, 19:33
Static task
static1
Behavioral task
behavioral1
Sample
TF711147-CM.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
TF711147-CM.exe
Resource
win10v2004-20230831-en
General
-
Target
TF711147-CM.exe
-
Size
593KB
-
MD5
b1fad5b1225486fbefc01d8d984364c2
-
SHA1
4ea620ca7e4a86844b89b20f3229ae7917909a34
-
SHA256
937f4dc642813c7c6148e69841fa3111c68ace1e44d4690b1bd0074fc5ea6915
-
SHA512
ac7895d920542ec58096b488eac8d166ae9a0d3c3e334c56276b3bf3dea04b959048cc38e374ec1d08e6acc838bae2dd52d1fc1f16d4e89112ec44cbe4c3da84
-
SSDEEP
6144:SgORa6xKTuuuqjL7IMLeSaDsyZz8ZpgXenwCSJ1566NWZPu+b1GwXDD5I4CLyPbM:Sgm/SaTzl2wXOZzYwXDgyDQxZQ8IO
Malware Config
Signatures
-
Loads dropped DLL 8 IoCs
pid Process 3068 TF711147-CM.exe 3068 TF711147-CM.exe 3068 TF711147-CM.exe 3068 TF711147-CM.exe 3068 TF711147-CM.exe 3068 TF711147-CM.exe 3068 TF711147-CM.exe 3068 TF711147-CM.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\resources\0409\eviler.sst TF711147-CM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1608 3068 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3068 wrote to memory of 1608 3068 TF711147-CM.exe 28 PID 3068 wrote to memory of 1608 3068 TF711147-CM.exe 28 PID 3068 wrote to memory of 1608 3068 TF711147-CM.exe 28 PID 3068 wrote to memory of 1608 3068 TF711147-CM.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\TF711147-CM.exe"C:\Users\Admin\AppData\Local\Temp\TF711147-CM.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 5402⤵
- Program crash
PID:1608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD56e55a6e7c3fdbd244042eb15cb1ec739
SHA1070ea80e2192abc42f358d47b276990b5fa285a9
SHA256acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
SHA5122d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
-
Filesize
7KB
MD5ec9c99216ef11cdd85965e78bc797d2c
SHA11d5f93fbf4f8aab8164b109e9e1768e7b80ad88c
SHA256c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df
SHA51235ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1
-
Filesize
12KB
MD56e55a6e7c3fdbd244042eb15cb1ec739
SHA1070ea80e2192abc42f358d47b276990b5fa285a9
SHA256acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
SHA5122d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
-
Filesize
12KB
MD56e55a6e7c3fdbd244042eb15cb1ec739
SHA1070ea80e2192abc42f358d47b276990b5fa285a9
SHA256acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
SHA5122d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
-
Filesize
7KB
MD5ec9c99216ef11cdd85965e78bc797d2c
SHA11d5f93fbf4f8aab8164b109e9e1768e7b80ad88c
SHA256c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df
SHA51235ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1
-
Filesize
7KB
MD5ec9c99216ef11cdd85965e78bc797d2c
SHA11d5f93fbf4f8aab8164b109e9e1768e7b80ad88c
SHA256c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df
SHA51235ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1
-
Filesize
7KB
MD5ec9c99216ef11cdd85965e78bc797d2c
SHA11d5f93fbf4f8aab8164b109e9e1768e7b80ad88c
SHA256c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df
SHA51235ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1
-
Filesize
7KB
MD5ec9c99216ef11cdd85965e78bc797d2c
SHA11d5f93fbf4f8aab8164b109e9e1768e7b80ad88c
SHA256c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df
SHA51235ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1
-
Filesize
7KB
MD5ec9c99216ef11cdd85965e78bc797d2c
SHA11d5f93fbf4f8aab8164b109e9e1768e7b80ad88c
SHA256c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df
SHA51235ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1
-
Filesize
7KB
MD5ec9c99216ef11cdd85965e78bc797d2c
SHA11d5f93fbf4f8aab8164b109e9e1768e7b80ad88c
SHA256c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df
SHA51235ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1