3d0e65f50507037a6288b4610a2a8d43c47ad8d0c54221bd8fb77367befda397

Analysis

max time kernel
154s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2023, 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HttpSrv4WX_CY.exe
Size

1.2MB
MD5

59dc9632e92c0001095f44425c6878d1
SHA1

e0c48ef3842134f0d6c739e62ce66ef0e467010f
SHA256

3d0e65f50507037a6288b4610a2a8d43c47ad8d0c54221bd8fb77367befda397
SHA512

57b3f7fc30537bbcf7bee4e973eca4ce81170fbc01e8d19b3b9ae01a09bb93f3cfa3d237ff373a5a41260cc2fbc7f7d839a145a2cef2be774524157e2433193f
SSDEEP

12288:o1UNEFiZjcrd9c3YyHJOw88ATlJzJC26ONcsD11oJ5hjLAS2EfU9iEqC:pCImrd9Rij4b6kvR1WnXH2x0E

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4860	HttpSrv4WX_CY.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4860	HttpSrv4WX_CY.exe

C:\Users\Admin\AppData\Local\Temp\HttpSrv4WX_CY.exe
"C:\Users\Admin\AppData\Local\Temp\HttpSrv4WX_CY.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4860-0-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/4860-1-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/4860-2-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/4860-3-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/4860-14-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download