Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-1703_x64 -
resource
win10-20231023-en -
resource tags
arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system -
submitted
27-11-2023 20:45
Behavioral task
behavioral1
Sample
7a798f5bd9c05320ef9840303199adaae9a016c0b04bbb359182388068e776c4.exe
Resource
win10-20231023-en
General
-
Target
7a798f5bd9c05320ef9840303199adaae9a016c0b04bbb359182388068e776c4.exe
-
Size
1.5MB
-
MD5
d27a3a61b860aa33d97b51d57ef6d436
-
SHA1
0806d3fb05e900ec3c809c6f08b1628adb4a6324
-
SHA256
7a798f5bd9c05320ef9840303199adaae9a016c0b04bbb359182388068e776c4
-
SHA512
33b57987feab5504dfa0579882438f0c79a2e5430bd547da812df0dd6558be4087d91a8015cecc5b4688bdc90f053f69472b952354d00e4451ac845be7fdd6ab
-
SSDEEP
24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 7a798f5bd9c05320ef9840303199adaae9a016c0b04bbb359182388068e776c4.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" 7a798f5bd9c05320ef9840303199adaae9a016c0b04bbb359182388068e776c4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1352 schtasks.exe 4588 schtasks.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2520 wrote to memory of 1352 2520 7a798f5bd9c05320ef9840303199adaae9a016c0b04bbb359182388068e776c4.exe 71 PID 2520 wrote to memory of 1352 2520 7a798f5bd9c05320ef9840303199adaae9a016c0b04bbb359182388068e776c4.exe 71 PID 2520 wrote to memory of 1352 2520 7a798f5bd9c05320ef9840303199adaae9a016c0b04bbb359182388068e776c4.exe 71 PID 2520 wrote to memory of 4588 2520 7a798f5bd9c05320ef9840303199adaae9a016c0b04bbb359182388068e776c4.exe 73 PID 2520 wrote to memory of 4588 2520 7a798f5bd9c05320ef9840303199adaae9a016c0b04bbb359182388068e776c4.exe 73 PID 2520 wrote to memory of 4588 2520 7a798f5bd9c05320ef9840303199adaae9a016c0b04bbb359182388068e776c4.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a798f5bd9c05320ef9840303199adaae9a016c0b04bbb359182388068e776c4.exe"C:\Users\Admin\AppData\Local\Temp\7a798f5bd9c05320ef9840303199adaae9a016c0b04bbb359182388068e776c4.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST2⤵
- Creates scheduled task(s)
PID:1352
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST2⤵
- Creates scheduled task(s)
PID:4588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5d27a3a61b860aa33d97b51d57ef6d436
SHA10806d3fb05e900ec3c809c6f08b1628adb4a6324
SHA2567a798f5bd9c05320ef9840303199adaae9a016c0b04bbb359182388068e776c4
SHA51233b57987feab5504dfa0579882438f0c79a2e5430bd547da812df0dd6558be4087d91a8015cecc5b4688bdc90f053f69472b952354d00e4451ac845be7fdd6ab