484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08-10-2023 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623.exe
Size

3.6MB
MD5

16888ee835bfc3300e58b58ae21d2ffb
SHA1

911e495377c975a73554762f158d0ee5535e1fdc
SHA256

484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623
SHA512

46805fcce1233479023ca000d901544e50480891542ca5e818769ef394b3d3f65888b2a1af243f338bb42682de50f6f45ffc4d296e1cd064361330eb3710b1ed
SSDEEP

98304:SheS9YvPe2AQRTPCKez970Z/6b9HC8ds1m1FE/Daqj+TP5DZxpFsM8c7em/dtDm7:IYvPesZak1m1FSSxNxpFsM8cDW

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2604	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2308	Gueyxmh.exe

Loads dropped DLL 1 IoCs

pid	Process
2464	484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2464	484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2464	484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623.exe
2308	Gueyxmh.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2308	2464	484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623.exe	28
PID 2464 wrote to memory of 2308	2464	484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623.exe	28
PID 2464 wrote to memory of 2308	2464	484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623.exe	28
PID 2464 wrote to memory of 2308	2464	484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623.exe	28
PID 2464 wrote to memory of 2604	2464	484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623.exe	29
PID 2464 wrote to memory of 2604	2464	484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623.exe	29
PID 2464 wrote to memory of 2604	2464	484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623.exe	29
PID 2464 wrote to memory of 2604	2464	484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623.exe	29

C:\Users\Admin\AppData\Local\Temp\484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623.exe
"C:\Users\Admin\AppData\Local\Temp\484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Gueyxmh.exe
  "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Gueyxmh.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2308
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\484C0D~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Gueyxmh.exe

Filesize
3.6MB

MD5
16888ee835bfc3300e58b58ae21d2ffb

SHA1
911e495377c975a73554762f158d0ee5535e1fdc

SHA256
484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623

SHA512
46805fcce1233479023ca000d901544e50480891542ca5e818769ef394b3d3f65888b2a1af243f338bb42682de50f6f45ffc4d296e1cd064361330eb3710b1ed

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Gueyxmh.exe

Filesize
3.6MB

MD5
16888ee835bfc3300e58b58ae21d2ffb

SHA1
911e495377c975a73554762f158d0ee5535e1fdc

SHA256
484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623

SHA512
46805fcce1233479023ca000d901544e50480891542ca5e818769ef394b3d3f65888b2a1af243f338bb42682de50f6f45ffc4d296e1cd064361330eb3710b1ed

Download Submit
C:\Users\Public\Documents\pass.txt

Filesize
8B

MD5
71d864b6b132a9235400af39917131b3

SHA1
b79d02acde8be0d57bedef9bd3edeab0a5a066f3

SHA256
f4392ea35b8bafc5813b48055be473c4eceb72f11936a67a92cd9086efc2492e

SHA512
f331a1c933e016667682d3339784e57f4518305954a7e02643b4deab5ff8ded663232f38190d535457f4351d506f642cea961ea09dc3182c7917f8e483dbd0d3

Download Submit
\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Gueyxmh.exe

Filesize
3.6MB

MD5
16888ee835bfc3300e58b58ae21d2ffb

SHA1
911e495377c975a73554762f158d0ee5535e1fdc

SHA256
484c0dd5e888d0ef7153f6b7d9fad5e45ff9512ff9c3b6c031a0c40ce0588623

SHA512
46805fcce1233479023ca000d901544e50480891542ca5e818769ef394b3d3f65888b2a1af243f338bb42682de50f6f45ffc4d296e1cd064361330eb3710b1ed

Download Submit
memory/2464-2-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download