ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2

Analysis

max time kernel
151s
max time network
121s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
17/11/2023, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
Size

15.8MB
MD5

2ab8741264f14205ee81d3f85bc988cb
SHA1

398a0cbc4b459610d8bc5ccb3fc0ad78c9feb34f
SHA256

ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2
SHA512

3afed036ca5a99a14d18bc335482a2353d8d1cc92d146d7e05be7c32138cc211a1e7b98a7a6026000723d438a7292c5189541b5d69c771b9ed6aed1da36ab534
SSDEEP

393216:FqHJA4+70r2bcZhaOwVLV5dEEKYOUYQjNVpvhf8fzvju4:IHGP7oaLxTKbY1Cfzv9

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 808	840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe	29
PID 840 wrote to memory of 808	840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe	29
PID 840 wrote to memory of 808	840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe	29
PID 840 wrote to memory of 808	840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe	29
PID 840 wrote to memory of 2300	840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe	30
PID 840 wrote to memory of 2300	840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe	30
PID 840 wrote to memory of 2300	840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe	30
PID 840 wrote to memory of 2300	840	ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe	30

C:\Users\Admin\AppData\Local\Temp\ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe
"C:\Users\Admin\AppData\Local\Temp\ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\*b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exe"
  2⤵
  PID:808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\*.dll"
  2⤵
  PID:2300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ba8b6d777b53e0ff9961ce4a5a1a86da66ce4644e80c72951e0cb02136d5f4d2.exepack.tmp

Filesize
2KB

MD5
6b30564f0ee3b11723ca672eb8b2be5f

SHA1
cb48e639a5534ad46f56e126fb1d7c827259fcdc

SHA256
6cd615ff2e9af0d33d5fc318f0289243536f3f2d40ffe5df865dc6a1952675a4

SHA512
798046c4193c8c64bb64fbb83ee542133f80834ea72d9fe2fd9305202348956a7cb4d2ba6b1719d286c28a18edd07652fc28849042ef320bf2272cb6c728a368

Download Submit
C:\Users\Admin\AppData\Local\Temp\e7d95b7c8b98076d0e8f0ec28f28b307.ini

Filesize
3KB

MD5
09450a3e36732280d8c80b5ce0ab151d

SHA1
606d384d1dccf760c4b840da59ed2c0e7c78622c

SHA256
a7dcd30a6d3a1e4512584379875633ef31a488910deb6a931ce053814b5e7f24

SHA512
cffe375979be65e045a5fdd15b9463798af04f7f77f939c9e866db1cb59cf841ae0e1ccf69c214b4d63366c773d412c52d5daf67f2c35fbb3538994c8adb786e

Download Submit
C:\Users\Admin\AppData\Local\Temp\e7d95b7c8b98076d0e8f0ec28f28b307A.ini

Filesize
1KB

MD5
43af9f4a1e6924060bb6bf4cb1f9192e

SHA1
a4b865504d8c6db72ee2009f3d7cf40fcef6a222

SHA256
6e4990207985cacc501844f9cbc89781cdbbef6f9c80315a5a6aade31578c9cb

SHA512
f91e45af41ddd85ceb6155d3f833b5ef15a3a9152a905f9d1eb8732184e2fe59e1abc1453c917f11f2fe5bb538c127ab3b6dd4e85b0d9b50f1732c27c28c4f77

Download Submit
memory/840-339-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/840-341-0x0000000000400000-0x0000000001FDC000-memory.dmp

Filesize
27.9MB

Download
memory/840-5-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/840-2-0x0000000000400000-0x0000000001FDC000-memory.dmp

Filesize
27.9MB

Download
memory/840-1-0x00000000003E0000-0x00000000003E3000-memory.dmp

Filesize
12KB

Download
memory/840-337-0x0000000000400000-0x0000000001FDC000-memory.dmp

Filesize
27.9MB

Download
memory/840-338-0x00000000003E0000-0x00000000003E3000-memory.dmp

Filesize
12KB

Download
memory/840-0-0x0000000000400000-0x0000000001FDC000-memory.dmp

Filesize
27.9MB

Download
memory/840-340-0x0000000000400000-0x0000000001FDC000-memory.dmp

Filesize
27.9MB

Download
memory/840-6-0x0000000000400000-0x0000000001FDC000-memory.dmp

Filesize
27.9MB

Download
memory/840-342-0x0000000000400000-0x0000000001FDC000-memory.dmp

Filesize
27.9MB

Download
memory/840-343-0x0000000000400000-0x0000000001FDC000-memory.dmp

Filesize
27.9MB

Download
memory/840-344-0x0000000000400000-0x0000000001FDC000-memory.dmp

Filesize
27.9MB

Download
memory/840-345-0x0000000000400000-0x0000000001FDC000-memory.dmp

Filesize
27.9MB

Download
memory/840-346-0x0000000000400000-0x0000000001FDC000-memory.dmp

Filesize
27.9MB

Download
memory/840-347-0x0000000000400000-0x0000000001FDC000-memory.dmp

Filesize
27.9MB

Download
memory/840-348-0x0000000000400000-0x0000000001FDC000-memory.dmp

Filesize
27.9MB

Download
memory/840-349-0x0000000000400000-0x0000000001FDC000-memory.dmp

Filesize
27.9MB

Download
memory/840-350-0x0000000000400000-0x0000000001FDC000-memory.dmp

Filesize
27.9MB

Download
memory/840-351-0x0000000000400000-0x0000000001FDC000-memory.dmp

Filesize
27.9MB

Download