db3c57e1b733bedfa3def09cb000fd4bd1918dcbedc545a5be90bd0fee4bfde7

Analysis

max time kernel
120s
max time network
142s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42814dec4f6211a12ba3524aa0b4949e_JC.exe
Size

208KB
MD5

42814dec4f6211a12ba3524aa0b4949e
SHA1

55054838b5fb7405d414a175aa854d49811f266f
SHA256

db3c57e1b733bedfa3def09cb000fd4bd1918dcbedc545a5be90bd0fee4bfde7
SHA512

0dff7c6172801cf0d4382845f8444508b69c40a38825c8611d352fc94bee68b848aab81bb72737c85d71c7a5f24cbf1b159e671db71e7c77b64111d71fa66614
SSDEEP

3072:7BAFpE3MG2YP6/U7hJcoW+y9mLQl/oJNXBp7H6WTM4NLthEjQT6j:7BAFpE3MM687hJcnWQ5ozXBllMQEj1

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2720	VDA.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\windows\VDA.exe	42814dec4f6211a12ba3524aa0b4949e_JC.exe
File opened for modification	C:\windows\VDA.exe	42814dec4f6211a12ba3524aa0b4949e_JC.exe
File created	C:\windows\VDA.exe.bat	42814dec4f6211a12ba3524aa0b4949e_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2416	42814dec4f6211a12ba3524aa0b4949e_JC.exe
2720	VDA.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2416	42814dec4f6211a12ba3524aa0b4949e_JC.exe
2416	42814dec4f6211a12ba3524aa0b4949e_JC.exe
2720	VDA.exe
2720	VDA.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2248	2416	42814dec4f6211a12ba3524aa0b4949e_JC.exe	28
PID 2416 wrote to memory of 2248	2416	42814dec4f6211a12ba3524aa0b4949e_JC.exe	28
PID 2416 wrote to memory of 2248	2416	42814dec4f6211a12ba3524aa0b4949e_JC.exe	28
PID 2416 wrote to memory of 2248	2416	42814dec4f6211a12ba3524aa0b4949e_JC.exe	28
PID 2248 wrote to memory of 2720	2248	cmd.exe	30
PID 2248 wrote to memory of 2720	2248	cmd.exe	30
PID 2248 wrote to memory of 2720	2248	cmd.exe	30
PID 2248 wrote to memory of 2720	2248	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\42814dec4f6211a12ba3524aa0b4949e_JC.exe
"C:\Users\Admin\AppData\Local\Temp\42814dec4f6211a12ba3524aa0b4949e_JC.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\windows\VDA.exe.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\windows\VDA.exe
    C:\windows\VDA.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\VDA.exe

Filesize
208KB

MD5
331c9e9433e544199f2235af9c36b193

SHA1
5f3ee5ca6b91ed14c67431ef8191552035f4d8f3

SHA256
f587b60ccd5f07152e76592e595685e909f43db414c4e2c54d338ef516595c91

SHA512
62cb800ff581c4c6c52b80e90b9e4b6e657aeecb885c3caf57b81b7e68b4a3716240e1b9cc56b4c4ac6c632d218e547abec8dea1f8728fc4034949cccf56de63

Download Submit
C:\Windows\VDA.exe.bat

Filesize
52B

MD5
a7feb6b8f3c4266d370afb4877557912

SHA1
38a966cedcf2fe981daf2cbda7ac8fe04c7dc229

SHA256
ea48a8f68eb75088b046b3a04ec1f5fce3b571a8f5f1a79b9975284fcf494fed

SHA512
780d8e6b16f6ee0cce193cbc1b28b1579b487fb017f525b199131def598211237c09e3628aa36f85e470aded211cb9122be30927fa855e1a094ee775b1b9ff98

Download Submit
C:\windows\VDA.exe

Filesize
208KB

MD5
331c9e9433e544199f2235af9c36b193

SHA1
5f3ee5ca6b91ed14c67431ef8191552035f4d8f3

SHA256
f587b60ccd5f07152e76592e595685e909f43db414c4e2c54d338ef516595c91

SHA512
62cb800ff581c4c6c52b80e90b9e4b6e657aeecb885c3caf57b81b7e68b4a3716240e1b9cc56b4c4ac6c632d218e547abec8dea1f8728fc4034949cccf56de63

Download Submit
C:\windows\VDA.exe.bat

Filesize
52B

MD5
a7feb6b8f3c4266d370afb4877557912

SHA1
38a966cedcf2fe981daf2cbda7ac8fe04c7dc229

SHA256
ea48a8f68eb75088b046b3a04ec1f5fce3b571a8f5f1a79b9975284fcf494fed

SHA512
780d8e6b16f6ee0cce193cbc1b28b1579b487fb017f525b199131def598211237c09e3628aa36f85e470aded211cb9122be30927fa855e1a094ee775b1b9ff98

Download Submit
memory/2248-15-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2248-16-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2248-19-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2416-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2416-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2720-18-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2720-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download