Analysis
-
max time kernel
1s -
max time network
11s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
26-10-2023 01:23
Static task
static1
Behavioral task
behavioral1
Sample
response_1697949825996.json
Resource
win7-20231020-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
response_1697949825996.json
Resource
win10v2004-20231023-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
response_1697949825996.json
-
Size
2B
-
MD5
99914b932bd37a50b983c5e7c90ae93b
-
SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
-
SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
-
SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_Classes\Local Settings rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 2508 wrote to memory of 1888 2508 cmd.exe rundll32.exe PID 2508 wrote to memory of 1888 2508 cmd.exe rundll32.exe PID 2508 wrote to memory of 1888 2508 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\response_1697949825996.json1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\response_1697949825996.json2⤵
- Modifies registry class