c95afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2023, 00:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c95afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00.exe
Size 6.9MB
Sample231024-axm5nahd9t
SHA256 c95afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00
MD5 de08ff53c094052055c558367c4346ad
SHA1 fe33ace189900b64276f6189a2acf49caf3b6fc4
SHA512 f217681b0f46bc34a80754aeef72f8eb2e2f7458c497d9ec290faba0c93db76139996e3aec41b17eaada7fd3c5976a74b6ecea8a859a98cefdb932d28a3625b3
SSDEEP 98304:1/FctrkPNFP3T9uqg+qTnxLMZLumaffE9PzhSrci2A8Wzu8bO8Eu9kAe1f53C+0/:MtrIhuqg9h0umaffO0j2A8Eqbu9Zs880
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3924	c95afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00.exe
3924	c95afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00.exe
3924	c95afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00.exe
3924	c95afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 1608	3924	c95afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00.exe	84
PID 3924 wrote to memory of 1608	3924	c95afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00.exe	84
PID 3924 wrote to memory of 1608	3924	c95afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00.exe	84
PID 3924 wrote to memory of 404	3924	c95afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00.exe	85
PID 3924 wrote to memory of 404	3924	c95afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00.exe	85
PID 3924 wrote to memory of 404	3924	c95afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00.exe	85

C:\Users\Admin\AppData\Local\Temp\c95afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00.exe
"C:\Users\Admin\AppData\Local\Temp\c95afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\*afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00.exe"
  2⤵
  PID:1608
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\*.dll"
  2⤵
  PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b5d40b16406c7e3e6ed1706332dc20bc.ini

Path C:\Users\Admin\AppData\Local\Temp\b5d40b16406c7e3e6ed1706332dc20bc.ini
Size 1KB
SHA256 1012250719c78019aaca9204351ad53c76abacae5afaa913c14f9a823af3d7db
MD5 7e4049041ef45887bf9ed3aa466dc744
SHA1 acbefd04986ff454a01d7d374bf67dee788ad575
SHA512 6ecd92c1d12ecbd87100c003dd7a26c19c9aa94fbc5ce355068f9cc234db61ad34104f0e35f3e23d83a57b0f42e35104977e3f066602d0915a51b3afbdd32a8a
MD5 SHA1 SHA512

Submit Download

b5d40b16406c7e3e6ed1706332dc20bcA.ini

Path C:\Users\Admin\AppData\Local\Temp\b5d40b16406c7e3e6ed1706332dc20bcA.ini
Size 1KB
SHA256 572eac27776fc7d214afa707ff3d7028ec46942a121d213446ccdc5d1a9c0d68
MD5 76438fa415ede2b2998bd7f32e10ad5b
SHA1 a75beb2ba6a10df6da92e053cd82cf248fd512a1
SHA512 fa3ad068ca08f74331464a76c1b0f17b052f4faf6b56b83184e0687ffa08f6aa59b036e628ba206aa8e952edc16388b76a9ec0ba094fb3d5bbfef1ca06cadd3f
MD5 SHA1 SHA512

Submit Download

c95afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00.exepack.tmp

Path C:\Users\Admin\AppData\Local\Temp\c95afb1560912270a7d90ff60c599d7051c8d4b43f354893e2301ba6d7bcca00.exepack.tmp
Size 2KB
SHA256 b883a96aa3c2622957949fb3cbbf646c0c7409fd5c662adbbbe57ab653c19998
MD5 99b223f8ea96c21c10b3fb0d8b387660
SHA1 90f1282aaabe319a1ab7c75981b1e5870373b935
SHA512 aa93b079bceebe83aec02eae62945d93d722c3804407bbc92bb0199d4f6e8fe0fd545b566f0b01083191a63c42f1ddbea1838fab1b357db9365fe90d01e169f0
MD5 SHA1 SHA512

Submit Download

memory/3924-0-0x0000000000400000-0x0000000001DBA000-memory.dmp

Download

memory/3924-1-0x0000000001EA0000-0x0000000001EA3000-memory.dmp

Download

memory/3924-2-0x0000000000400000-0x0000000001DBA000-memory.dmp

Download

memory/3924-5-0x0000000050000000-0x0000000050109000-memory.dmp

Download

memory/3924-327-0x0000000000400000-0x0000000001DBA000-memory.dmp

Download

memory/3924-329-0x0000000001EA0000-0x0000000001EA3000-memory.dmp

Download

memory/3924-338-0x0000000050000000-0x0000000050109000-memory.dmp

Download

memory/3924-339-0x0000000000400000-0x0000000001DBA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads