b43508fe91fd53f193da72e96c24946f99b254a8f0de1dc37735b5d26b06204e

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
29/10/2023, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2 .exe
Size

160KB
MD5

3d0d2c358dab0128baad6087f730576e
SHA1

2b3efc5f663c1bd12cf5ab4b4fa74c63917cbcba
SHA256

ce97d204315dc330a2a817c59fc63db66591567b0dd141d094ebd1ff346031c9
SHA512

d8ec79745c0fcc3c8b71dfed482a289c2c2c7dee1e3f2220cdd5d9b29754289958cb1e87fb292a611c48176d5d4a0ced090bacd3c048046e74cde8e70c63ddd1
SSDEEP

1536:A1LqlA26Dcet3fubej6jF7/qYeN3wVZh:kLqyvh3fABjFwwXh

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\hidefileext = "1"	2 .exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\windows\Dos.txt	2 .exe
File created	C:\windows\Dos.txt	2 .exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2204	2 .exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2940	2204	2 .exe	28
PID 2204 wrote to memory of 2940	2204	2 .exe	28
PID 2204 wrote to memory of 2940	2204	2 .exe	28
PID 2204 wrote to memory of 2940	2204	2 .exe	28

C:\Users\Admin\AppData\Local\Temp\2 .exe
"C:\Users\Admin\AppData\Local\Temp\2 .exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\windows\explorer.exe
  C:\windows\explorer.exe
  2⤵
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2204-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2204-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download