Analysis

  • max time kernel
    118s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    02-12-2023 01:37

General

  • Target

    1e66d672ef74c30de5850158ca37687aa28edff794e6300a9c86c1085f83b9a0.exe

  • Size

    131.3MB

  • MD5

    e2660cb6a6bd50aa797e4207c6a180c9

  • SHA1

    ae9dd51791ec21218386f809f45342faaa723eee

  • SHA256

    1e66d672ef74c30de5850158ca37687aa28edff794e6300a9c86c1085f83b9a0

  • SHA512

    0cfec841f83be0f8d0be6c8731767d4640080b6d8aa303477b3210836e245b0053ae00f412357bbd8f1941ce999375f4b41df880cece05e6d7f4d9a5f21cd2ea

  • SSDEEP

    786432:ny/QyHIQunIAHj37Enk9s9x0G/EgnTp/lo7oZ4AzGpHjUoFmnTtLwSTRpf4P1wTo:y/hSq0cTp9ioZ4AzGNFK5vy9

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Modifies system certificate store 2 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e66d672ef74c30de5850158ca37687aa28edff794e6300a9c86c1085f83b9a0.exe
    "C:\Users\Admin\AppData\Local\Temp\1e66d672ef74c30de5850158ca37687aa28edff794e6300a9c86c1085f83b9a0.exe"
    1⤵
    • Modifies system certificate store
    PID:2840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2840-0-0x0000000006960000-0x00000000072E8000-memory.dmp

    Filesize

    9.5MB

  • memory/2840-3-0x0000000006960000-0x00000000072E8000-memory.dmp

    Filesize

    9.5MB

  • memory/2840-5-0x0000000000AD0000-0x0000000001335000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-4-0x0000000007EE0000-0x0000000008AC9000-memory.dmp

    Filesize

    11.9MB

  • memory/2840-8-0x0000000007EE0000-0x0000000008AC9000-memory.dmp

    Filesize

    11.9MB

  • memory/2840-9-0x0000000000A40000-0x0000000000A51000-memory.dmp

    Filesize

    68KB

  • memory/2840-13-0x0000000006330000-0x00000000063E4000-memory.dmp

    Filesize

    720KB

  • memory/2840-12-0x0000000000A40000-0x0000000000A51000-memory.dmp

    Filesize

    68KB

  • memory/2840-16-0x0000000006330000-0x00000000063E4000-memory.dmp

    Filesize

    720KB

  • memory/2840-17-0x0000000000AC0000-0x0000000000ACC000-memory.dmp

    Filesize

    48KB

  • memory/2840-20-0x0000000000AC0000-0x0000000000ACC000-memory.dmp

    Filesize

    48KB

  • memory/2840-21-0x0000000002770000-0x000000000278F000-memory.dmp

    Filesize

    124KB

  • memory/2840-24-0x0000000002770000-0x000000000278F000-memory.dmp

    Filesize

    124KB

  • memory/2840-25-0x0000000002790000-0x00000000027A5000-memory.dmp

    Filesize

    84KB

  • memory/2840-28-0x0000000002790000-0x00000000027A5000-memory.dmp

    Filesize

    84KB

  • memory/2840-29-0x00000000029A0000-0x00000000029D6000-memory.dmp

    Filesize

    216KB

  • memory/2840-32-0x00000000029A0000-0x00000000029D6000-memory.dmp

    Filesize

    216KB

  • memory/2840-33-0x00000000027F0000-0x0000000002802000-memory.dmp

    Filesize

    72KB

  • memory/2840-36-0x00000000027F0000-0x0000000002802000-memory.dmp

    Filesize

    72KB

  • memory/2840-40-0x0000000002AB0000-0x0000000002ACD000-memory.dmp

    Filesize

    116KB

  • memory/2840-43-0x0000000002AB0000-0x0000000002ACD000-memory.dmp

    Filesize

    116KB

  • memory/2840-44-0x0000000002A30000-0x0000000002A6A000-memory.dmp

    Filesize

    232KB

  • memory/2840-47-0x0000000002A30000-0x0000000002A6A000-memory.dmp

    Filesize

    232KB

  • memory/2840-48-0x00000000064F0000-0x00000000065D9000-memory.dmp

    Filesize

    932KB

  • memory/2840-51-0x00000000064F0000-0x00000000065D9000-memory.dmp

    Filesize

    932KB

  • memory/2840-52-0x0000000006810000-0x000000000695A000-memory.dmp

    Filesize

    1.3MB

  • memory/2840-56-0x0000000007960000-0x0000000007AED000-memory.dmp

    Filesize

    1.6MB

  • memory/2840-55-0x0000000006810000-0x000000000695A000-memory.dmp

    Filesize

    1.3MB

  • memory/2840-59-0x0000000007960000-0x0000000007AED000-memory.dmp

    Filesize

    1.6MB

  • memory/2840-60-0x0000000002BA0000-0x0000000002BA6000-memory.dmp

    Filesize

    24KB

  • memory/2840-63-0x0000000002BA0000-0x0000000002BA6000-memory.dmp

    Filesize

    24KB

  • memory/2840-64-0x0000000002BB0000-0x0000000002BB9000-memory.dmp

    Filesize

    36KB

  • memory/2840-67-0x0000000002BB0000-0x0000000002BB9000-memory.dmp

    Filesize

    36KB

  • memory/2840-140-0x0000000000AD0000-0x0000000001335000-memory.dmp

    Filesize

    8.4MB