57e25bf62b0ee2ac77f33d915996e2a65236b656a0d04aab0c94de959d814c7f

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/12/2023, 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57e25bf62b0ee2ac77f33d915996e2a65236b656a0d04aab0c94de959d814c7f.exe
Size

2.7MB
MD5

81b7ed64271299e337887499b707e79c
SHA1

56e545c2e6f4997cc19d7dcfa7fb76df17db80c9
SHA256

57e25bf62b0ee2ac77f33d915996e2a65236b656a0d04aab0c94de959d814c7f
SHA512

7b361c3921a80854c3313e956451e5da040b2faec80c6dde919e5d05e39a374238bfc53dfb6ddf8250a17c1af4b99c6fe40e39c9618ef75f04eeb2cc520ea7c1
SSDEEP

49152:q3q7eN/sPgDU6dj+m+wT9GVoxDyVnFcp0oYPa3/l2tbHm7U7:qpN0PgDUZm+g9GVoxWZFOx

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\imyfone_down\57e25bf62b0ee2ac77f33d915996e2a65236b656a0d04aab0c94de959d814c7f\Log\imyfone_down.log	57e25bf62b0ee2ac77f33d915996e2a65236b656a0d04aab0c94de959d814c7f.exe
File created	C:\Program Files (x86)\imyfone_down\57e25bf62b0ee2ac77f33d915996e2a65236b656a0d04aab0c94de959d814c7f\language\Őv	57e25bf62b0ee2ac77f33d915996e2a65236b656a0d04aab0c94de959d814c7f.exe
File opened for modification	C:\Program Files (x86)\imyfone_down\57e25bf62b0ee2ac77f33d915996e2a65236b656a0d04aab0c94de959d814c7f\language\Őv	57e25bf62b0ee2ac77f33d915996e2a65236b656a0d04aab0c94de959d814c7f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	2356	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1984	2356	57e25bf62b0ee2ac77f33d915996e2a65236b656a0d04aab0c94de959d814c7f.exe	28
PID 2356 wrote to memory of 1984	2356	57e25bf62b0ee2ac77f33d915996e2a65236b656a0d04aab0c94de959d814c7f.exe	28
PID 2356 wrote to memory of 1984	2356	57e25bf62b0ee2ac77f33d915996e2a65236b656a0d04aab0c94de959d814c7f.exe	28
PID 2356 wrote to memory of 1984	2356	57e25bf62b0ee2ac77f33d915996e2a65236b656a0d04aab0c94de959d814c7f.exe	28

C:\Users\Admin\AppData\Local\Temp\57e25bf62b0ee2ac77f33d915996e2a65236b656a0d04aab0c94de959d814c7f.exe
"C:\Users\Admin\AppData\Local\Temp\57e25bf62b0ee2ac77f33d915996e2a65236b656a0d04aab0c94de959d814c7f.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 284
  2⤵
  - Program crash
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\imyfone_down\57e25bf62b0ee2ac77f33d915996e2a65236b656a0d04aab0c94de959d814c7f\language\Őv

Filesize
128KB

MD5
0dfbe8aa4c20b52e1b8bf3cb6cbdf193

SHA1
67dfd19f3eb3649d6f3f6631e44d0bd36b8d8d19

SHA256
fa43239bcee7b97ca62f007cc68487560a39e19f74f3dde7486db3f98df8e471

SHA512
4ed83e40c9cf32ac2c59125a01170bc97f20550952c8ca20ffe1b2a59d1b1ed9c8426c515f7629d1bb5e4cdc53dd70ffcf67203d59e70a559492e5ff0e712278

Download Submit