e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
12/11/2023, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe
Size

1.5MB
MD5

14b767301d26dd2dc9d507b8aeaa4841
SHA1

32054ef0212186497a6fe936faeb992b03446a48
SHA256

e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866
SHA512

3a6f84eddae25fd82dd7cd1f905fbd5a73f70e40f1c0127a67e723b48167b17cf1618996b2c63f81bfe5ac2ad494d634b2dada1ea1c58f4823ea44a87131371d
SSDEEP

24576:DUFHwm4CtRmio7XmKFID/kZECDx00Nltv/LQ57bJs8yqJsJk:DcwMmiwmQITiECLtvDQBbCqJA

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1144	svchost.exe
2620	svchost.exe
2024	svchost.exe

Loads dropped DLL 3 IoCs

pid	Process
2708	e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe
2488	WerFault.exe
2488	WerFault.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2488	2620	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1144	svchost.exe
2620	svchost.exe
1144	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2708	e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe
2708	e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe
2708	e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 1144	2708	e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe	28
PID 2708 wrote to memory of 1144	2708	e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe	28
PID 2708 wrote to memory of 1144	2708	e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe	28
PID 2708 wrote to memory of 1144	2708	e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe	28
PID 2620 wrote to memory of 2024	2620	svchost.exe	30
PID 2620 wrote to memory of 2024	2620	svchost.exe	30
PID 2620 wrote to memory of 2024	2620	svchost.exe	30
PID 2620 wrote to memory of 2024	2620	svchost.exe	30
PID 2620 wrote to memory of 2488	2620	svchost.exe	31
PID 2620 wrote to memory of 2488	2620	svchost.exe	31
PID 2620 wrote to memory of 2488	2620	svchost.exe	31
PID 2620 wrote to memory of 2488	2620	svchost.exe	31
PID 1144 wrote to memory of 2732	1144	svchost.exe	32
PID 1144 wrote to memory of 2732	1144	svchost.exe	32
PID 1144 wrote to memory of 2732	1144	svchost.exe	32
PID 1144 wrote to memory of 2732	1144	svchost.exe	32

C:\Users\Admin\AppData\Local\Temp\e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe
"C:\Users\Admin\AppData\Local\Temp\e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\0.vbs"
    3⤵
    PID:2732

C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe
"C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe
  "C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe" Win7
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 228
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\0.vbs

Filesize
500B

MD5
50a08ac434f85249aeb4480f11d0b174

SHA1
3785e37a0702a74bd9752169c0395807a744a1b5

SHA256
7cb5b0b029f00d79c0262941520b54391f838f91fdba887d220e984f0572b382

SHA512
c42bf506e43c57961d2962a2d7ecf14a713a685d806086d8e4c9764eadb18ab12749eb19621b389a17bee6acd22ad4f6ab3ad4efa1d511e241512fafd5af4049

Download Submit
C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe

Filesize
68KB

MD5
5395328696453d78c565bfd81e8d3f99

SHA1
3c1c265e277d47af7ad7ace0ba45d682bd0f24e3

SHA256
b005ced9ff2c6c997a693064132b6567282c9dc440968020a880a4a193fc5b92

SHA512
69c02ac7cfb7e4f27436aeba637e78b1be58d1bf2a1d3643afb8c443a348c444dd6f0e44ea6a2c795eae21e93315a34f6cd07f986fc57b2e2289d917076a825e

Download Submit
C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe

Filesize
68KB

MD5
5395328696453d78c565bfd81e8d3f99

SHA1
3c1c265e277d47af7ad7ace0ba45d682bd0f24e3

SHA256
b005ced9ff2c6c997a693064132b6567282c9dc440968020a880a4a193fc5b92

SHA512
69c02ac7cfb7e4f27436aeba637e78b1be58d1bf2a1d3643afb8c443a348c444dd6f0e44ea6a2c795eae21e93315a34f6cd07f986fc57b2e2289d917076a825e

Download Submit
C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe

Filesize
68KB

MD5
5395328696453d78c565bfd81e8d3f99

SHA1
3c1c265e277d47af7ad7ace0ba45d682bd0f24e3

SHA256
b005ced9ff2c6c997a693064132b6567282c9dc440968020a880a4a193fc5b92

SHA512
69c02ac7cfb7e4f27436aeba637e78b1be58d1bf2a1d3643afb8c443a348c444dd6f0e44ea6a2c795eae21e93315a34f6cd07f986fc57b2e2289d917076a825e

Download Submit
C:\Windows\svchost.exe

Filesize
68KB

MD5
5395328696453d78c565bfd81e8d3f99

SHA1
3c1c265e277d47af7ad7ace0ba45d682bd0f24e3

SHA256
b005ced9ff2c6c997a693064132b6567282c9dc440968020a880a4a193fc5b92

SHA512
69c02ac7cfb7e4f27436aeba637e78b1be58d1bf2a1d3643afb8c443a348c444dd6f0e44ea6a2c795eae21e93315a34f6cd07f986fc57b2e2289d917076a825e

Download Submit
C:\Windows\svchost.exe

Filesize
68KB

MD5
5395328696453d78c565bfd81e8d3f99

SHA1
3c1c265e277d47af7ad7ace0ba45d682bd0f24e3

SHA256
b005ced9ff2c6c997a693064132b6567282c9dc440968020a880a4a193fc5b92

SHA512
69c02ac7cfb7e4f27436aeba637e78b1be58d1bf2a1d3643afb8c443a348c444dd6f0e44ea6a2c795eae21e93315a34f6cd07f986fc57b2e2289d917076a825e

Download Submit
C:\Windows\svchost.exe

Filesize
68KB

MD5
5395328696453d78c565bfd81e8d3f99

SHA1
3c1c265e277d47af7ad7ace0ba45d682bd0f24e3

SHA256
b005ced9ff2c6c997a693064132b6567282c9dc440968020a880a4a193fc5b92

SHA512
69c02ac7cfb7e4f27436aeba637e78b1be58d1bf2a1d3643afb8c443a348c444dd6f0e44ea6a2c795eae21e93315a34f6cd07f986fc57b2e2289d917076a825e

Download Submit
\Program Files (x86)\Microsoft Oeuqie\svchost.exe

Filesize
68KB

MD5
5395328696453d78c565bfd81e8d3f99

SHA1
3c1c265e277d47af7ad7ace0ba45d682bd0f24e3

SHA256
b005ced9ff2c6c997a693064132b6567282c9dc440968020a880a4a193fc5b92

SHA512
69c02ac7cfb7e4f27436aeba637e78b1be58d1bf2a1d3643afb8c443a348c444dd6f0e44ea6a2c795eae21e93315a34f6cd07f986fc57b2e2289d917076a825e

Download Submit
\Program Files (x86)\Microsoft Oeuqie\svchost.exe

Filesize
68KB

MD5
5395328696453d78c565bfd81e8d3f99

SHA1
3c1c265e277d47af7ad7ace0ba45d682bd0f24e3

SHA256
b005ced9ff2c6c997a693064132b6567282c9dc440968020a880a4a193fc5b92

SHA512
69c02ac7cfb7e4f27436aeba637e78b1be58d1bf2a1d3643afb8c443a348c444dd6f0e44ea6a2c795eae21e93315a34f6cd07f986fc57b2e2289d917076a825e

Download Submit
\Users\Admin\AppData\Local\Temp\x64dd.DLL

Filesize
832KB

MD5
46eb6c37460b1a9115edd9d6b1c279a6

SHA1
6c43291fdb934f9e9424c8ecde8d1a554ee3735b

SHA256
17ef93e0f8f09b9b97ceb9deaac145011669e64f768e184e17db345a128895d7

SHA512
a381f26deed1e5aa2217939fc37f3467bd4eb850310973978cf8d5d23cf41071856ef98fcc12b9541a521b1ed1266cc1516bacbf61c164a752b993a8024ad18b

Download Submit