051326d09f6c645ba186fa3627b92b2850d5e11836a63496d16a8a2d2d4d5e75

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3afb658dcdec94f731ab8074e50c75bc.exe
Size

140KB
MD5

3afb658dcdec94f731ab8074e50c75bc
SHA1

6cae15fda8dec66acc207f7342385ddd09b3531d
SHA256

051326d09f6c645ba186fa3627b92b2850d5e11836a63496d16a8a2d2d4d5e75
SHA512

47c5bf6e7799fb97b5a410538d7d2bbb869d5baddd342752febb79efede1d615895d05f8d63308ff9eeb83397df49598a54c259e389b4fcff3440846b5fa935f
SSDEEP

3072:/6pQc+sSxnTrGadgsFqZeo4pwkhUmZr3hPsOraSo:/6p2sSxTrGvsFUejWyZr3hPswaH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1752	3afb658dcdec94f731ab8074e50c75bc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 3008	1752	3afb658dcdec94f731ab8074e50c75bc.exe	28
PID 1752 wrote to memory of 3008	1752	3afb658dcdec94f731ab8074e50c75bc.exe	28
PID 1752 wrote to memory of 3008	1752	3afb658dcdec94f731ab8074e50c75bc.exe	28
PID 1752 wrote to memory of 3008	1752	3afb658dcdec94f731ab8074e50c75bc.exe	28
PID 3008 wrote to memory of 3004	3008	cmd.exe	30
PID 3008 wrote to memory of 3004	3008	cmd.exe	30
PID 3008 wrote to memory of 3004	3008	cmd.exe	30
PID 3008 wrote to memory of 3004	3008	cmd.exe	30

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3004	attrib.exe

C:\Users\Admin\AppData\Local\Temp\3afb658dcdec94f731ab8074e50c75bc.exe
"C:\Users\Admin\AppData\Local\Temp\3afb658dcdec94f731ab8074e50c75bc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\vab9919.tmp.bat" "C:\Users\Admin\AppData\Local\Temp\3afb658dcdec94f731ab8074e50c75bc.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\3afb658dcdec94f731ab8074e50c75bc.exe"
    3⤵
    - Views/modifies file attributes
    PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\vab9919.tmp.bat

Filesize
55B

MD5
1177f65e343d6c4bf525f463641a5f05

SHA1
03aaaccc5180f72b071220bc3d3722d5bb645001

SHA256
8c4da51f2266f11f16b8ee5f70bf258ad79ba49647808fca1096cc014a090a06

SHA512
67c240de366f6acd8f67182d4d8a5400dc417f17d72d91a51048268ec24db1c4ef59f6c3863eebce1503360ac8d3beafc8ef2a92849c25d12d971d729ea7a809

Download Submit
memory/1752-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1752-16-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download