Analysis
-
max time kernel
98s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
20-12-2023 13:07
Static task
static1
Behavioral task
behavioral1
Sample
b65427323350e8f21e50081ecf03987e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
b65427323350e8f21e50081ecf03987e.exe
Resource
win10v2004-20231215-en
General
-
Target
b65427323350e8f21e50081ecf03987e.exe
-
Size
212KB
-
MD5
b65427323350e8f21e50081ecf03987e
-
SHA1
07be7f355a4d6383880e23bf83eee21d8897715b
-
SHA256
3d77377ed8f959598d211aaab147bc5b7d4e33fd3b24492b5d3b911ff197e17a
-
SHA512
51ba46989c360bb7c5d617124b12ecdd46e6f85b7316f6179d7b7c772c7233101273cd4732eba0b30198cf8ef81c717d465e35462417616342c352cda654729a
-
SSDEEP
6144:xC6fd/H2abLXuSEKpBdhyEmeu4Af3RA2:xCKduabs8BdhUedAf3R
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3060 KvWfQhistrep.exe -
Loads dropped DLL 2 IoCs
pid Process 2668 b65427323350e8f21e50081ecf03987e.exe 2668 b65427323350e8f21e50081ecf03987e.exe -
Modifies file permissions 1 TTPs 3 IoCs
pid Process 2132 icacls.exe 588 icacls.exe 584 icacls.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2668 wrote to memory of 3060 2668 b65427323350e8f21e50081ecf03987e.exe 30 PID 2668 wrote to memory of 3060 2668 b65427323350e8f21e50081ecf03987e.exe 30 PID 2668 wrote to memory of 3060 2668 b65427323350e8f21e50081ecf03987e.exe 30 PID 2668 wrote to memory of 3060 2668 b65427323350e8f21e50081ecf03987e.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\b65427323350e8f21e50081ecf03987e.exe"C:\Users\Admin\AppData\Local\Temp\b65427323350e8f21e50081ecf03987e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\KvWfQhistrep.exe"C:\Users\Admin\AppData\Local\Temp\KvWfQhistrep.exe" 9 REP2⤵
- Executes dropped EXE
PID:3060
-
-
C:\Users\Admin\AppData\Local\Temp\lhtMwGjKPlan.exe"C:\Users\Admin\AppData\Local\Temp\lhtMwGjKPlan.exe" 8 LAN2⤵PID:1640
-
-
C:\Users\Admin\AppData\Local\Temp\opdOhHiWGlan.exe"C:\Users\Admin\AppData\Local\Temp\opdOhHiWGlan.exe" 8 LAN2⤵PID:1916
-
-
C:\Windows\SysWOW64\icacls.exeicacls "F:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:588
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:584
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2132
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵PID:2636
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:1644
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:1344
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:2256
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵PID:2912
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:2364
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:1772
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:2456
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD559af47851c29a3d8d0a8d243bf09018e
SHA152caf2f02867c7928551074f16c4cee49ff6fbb6
SHA25696ae5466bfaf66ed9a4896e2dee26037ed725136264c43c8ce10591ec405281d
SHA5120d581543ca33ee4605a755ebd7b1c57a5b982f034ed90fa5e66675d3d93cc283767a701570d163f78650642d4a4a986d99dfe4dbcb1d86a106ef020fad455b17
-
Filesize
832KB
MD55461a974f5c019532b3a9ae6c8d3f629
SHA1fe3afad8301f20db9322c316fb33c7c2dd3041a7
SHA256fcf49f4ab3d34f4591456825fb6b29b4edc2d7992342294a76dc965ae34c7ebc
SHA51207064809b0db79cfd552fa188e748ae3bf0d9a879fbf0a0d0827c52c35e2228421c58134f674f1adfd075120908df137aa40ffe8df08945b30cf3b53ef32cb10
-
Filesize
896KB
MD5b114cd58f9c9975bc2ec70364659ea79
SHA10122fa783da228929543cfc59bd4a11c400fbb50
SHA25679087dd2e04040f173284d80c1e5c7eb48a78450c91afc7fea76bb945b5a1d34
SHA512a56dae0dce7e76471c21ee9b4f363ab700997ac115899f8fcd3838d977f57bb752b965e904f7b823b4b1a771148ac9d8859ba9665bf69018807f06d7bf5a44c1
-
Filesize
17KB
MD5066db49c3992dc63101fb77975d6a078
SHA17c8772dba6616589b4e3efa0cf55fdd278f4eb8e
SHA25624c91325cd7f0efdb5fc94c99ef9cc8ccc81a4df9093ef49b87a47867dcf934d
SHA5123dff385575d51b143feb8c04fea088b3806a21b1cdc707cae229a8ec65742d0235f1f36faf02ca076651ee43ff5d0e16bf8548a0af1781009583c3b7e62a0d8d
-
Filesize
2.3MB
MD5359982dc96a9633c70a79098d1e57857
SHA10c5beb759fd048e4684f39e6260ba4a98fc53ed5
SHA25696e5800d7a1c618b1d0f3022fc7c97f6dd174c42aee0526e5c1faab7691fddc0
SHA512423542b1627984abf2d06a64dc90e73b193ca1b3c71399bd419052897af122afd05e242ed1378cc4a1a204da490c2dfb17fdb48034dd72511c9e318946902d5e
-
Filesize
2.2MB
MD59030fa08e5e3adfb7d7bc0accafb30b2
SHA1e3e55f099a3a8e49b14b1d12fd2f977eaba02432
SHA2563dd5b58638ae1754b90e8cba516fbc25e98950382513d7c73777d576c434286b
SHA512d9ee464756f19a43c2ebcc074d9962be1e257364b7f6ab9dc74ac453bd4389fa97f4a507c54f2bb665a4ad7bb9ddeb6e6b3662fbaef069cc6244153d88c49a52
-
Filesize
31KB
MD5181d2bb2dd902aac9e9be100bf812116
SHA1691fdea9241fac7b200c6eb896081b9d50570e87
SHA25652f5de75fd6921ad71606680f7237ae41e68f4c7014362c20a7082d5c56ac4b6
SHA51260fcb1a6443a1fe352afc223c8135eba3fafc82742a48b5459ec5138f6102e0bb7498c5b99f5fd4d9de405ef13a1e89a17b6e3d39605ca07d136d6ee20326b29
-
Filesize
448KB
MD5b7de4581842b1972d4cd91fc4c90d035
SHA1a352dbab6a703abc88b57cfa09b45c27b57333c3
SHA256f2f54569f00868500e086b48a74a0a1042f5087da86e4efa7a62754f376ecd17
SHA5122ab47e3bbd6f8e5865768740ac43011accce2598e3d887a11033faef62b03520de6a87b436a1f43317fd4ef8e65fdb287bb67cf1c12de7023968c7bd991b0090
-
Filesize
896KB
MD53288990e101512ca64536c51d107b6b2
SHA15e5b152b0043f0f3b18da7e988acf4adeca28aea
SHA256245dd8c94e686fd40034049a7bcf729f4f9a3761268e42589033673a824cdf39
SHA5126cb2171d15fb01b22756658222707f018eeee0034cb974b0de79e4e192591662b05ef76efa0f86d8351f0ab7ae09b973d32755ca1564cd3917253008139d4170
-
Filesize
832KB
MD58f8d33a4f83961c8ca6cc7a26b81fa07
SHA160491e19fce6c95aa5a8caa7f5247ab7e2bc79d1
SHA256b0723db1e133ac3359e95871c129a3dd6e52996fc9bc6533bda97c00cccf658d
SHA512d16ea64373c1205d21e0a789df867fe5cd80f6512a49b216646286af513325aea7c8678f3dcbfc23b3a3e4c21cc4e9150df167a5f34694aaac884a423f8bfa90
-
Filesize
1KB
MD59f3fd11b1d8e4ed734401d716d6810d0
SHA166f74b2ca928389e8e801460c7ae65c02f16e32c
SHA256c1aff25249d47c5a6ab726736f24b4c707be16183e52a42e354fe97f335d2db0
SHA51226816e22ab24a34f93592e742d3eead0de50297d29ebb73ba52eaf485a8de8f2df54acf7921d266b6f664fe24aafee66fb356222c85b95ebd6721889878f82d3
-
Filesize
2KB
MD5505f373d60ac875d1ff37610f9f93188
SHA10da64ccfbc2bd6f381b182cc4a05ff9c96045710
SHA2560e4edca8fb3b9e46787e25f36b3adc23e7b94992cf9e71d6dc5921ec994bd5e2
SHA51249a20353916215b27345e8b2c511292799d31dcf596296573fbab01d6e054198e4bc63ffe84e60853f46fcb9feb160a1b0a874627559d152236dd6e1d246630a
-
Filesize
768KB
MD5fe1113cba304164b7bddc886845d8578
SHA1d78676f6cd6b52c04d3532f84c6ad6a7eafb6f85
SHA2569cc41e9e6dc750c6a4c0a745525da8f42ec52ce145e5413da1843835b286e897
SHA5121bb489fea759101b6d3b713d567fb7f61d2d59a5396e7b33496db0b931416b333af386e72017d35fb0a1f8a0b81878965742907ac8a6a878af75b48c299c46df
-
Filesize
1KB
MD59217b47424680aeccaa40ec2a79d3220
SHA1c14c440bfefb6e0d4af89e43140639a5cfd72c78
SHA256658c1716531aa83fa6dbda71bd3728875374497f5ddc9ea99a2d63db4959b5bd
SHA512159bc18c10951fda6958f68a3703bd72bf8930349101c019a0adf8dc73f37cd9358e802c83cfbee7bcd1c925cb1bd90a9965f45a95b58510e24c8a8d3ba3962b
-
Filesize
2.1MB
MD5018d8e03082633d1832f04f217b77c30
SHA1da297f887a9067603fe393c954688f61394f18a0
SHA256edb70ffafd8a8f6a4992a6306df4bf693f8da059e2f1b9241709dd40cb0714e5
SHA5123d4734d895445c494086cb05121c083e46b5d333cc42b0b01d19816a6ca25124c944e5f2e304ddf02078bcf7889096ead7b0a8a23fb41d32476820759482903e
-
Filesize
2KB
MD503881e1871038f3af3857b0fc5abbf92
SHA135f10594b0bea7418d965fd4ce90305fef6ac0c6
SHA25640a7ead2173ab6327b7a666fb92c0e289df97db8be4542ea18a30d5b7d87b07a
SHA512283461bc273ffb9f92a94c241fcc8f97b2af99e298f378f6ce301f8596b429da8295a2538138792542a4acc417b14ab21b2e0113298aae5ecd82c65d64c0f5fd
-
Filesize
4.4MB
MD5993ddbd84ca4d5ff3f8c983561547f84
SHA1180c4810d1bec54ffa68639c645abf43ddd86aa0
SHA2560da7e160c180ad77b8846dfaaa1b60837d9c0d3924871fa97b1e14eda065b297
SHA51279d1bc638c596fdb0bea0719a35b674a1e18ce9bbfcaea4796b89752b5dbb3c5369fee5aba4c6a3f812747a751a387829a7d3f2183d86b02734997099e72f21d
-
Filesize
1.7MB
MD5a8d57d47e5c9e254ee74b63a75217967
SHA12fe1c84cbc2661225375eafd846d2ed8eae516ec
SHA2561aa3efd957169d17b4f08eae7e3a5f0403ce4dafed7581e011d2ab062905480a
SHA51225e2dd89a9047a5628ffaa84b049f193fae41647d653a6b2aacf50cad6eb851f48de13cb7eea80522e9f5c9f1179109f750aff623c78c590724a289e560a7100
-
Filesize
1KB
MD5d2f2db8843ea162554f0ebf033aca292
SHA160bc1617f7e5eed6adfdb0abf656fd85b96019f7
SHA2560f75ebc9b0ee1aedebcd2bb4cfe0aab54b1e3c150a03466b188dc254eb563edc
SHA5123a8bc5e1782c47a9b8b9c2e3485ee698eeb702b9a8cc3ab0efee9995c5483862736d017cb38822b60ae9eb7a5c264f400351e08c9eb371e109b74924cdf55551
-
Filesize
1KB
MD53bc89568d482b05e0ef3a6253cab0d8e
SHA1cae4d3e7ca62a6799efdb22dd192f56f0ea938af
SHA256f2ae652bdd283bf707fc9a5d4b898182f43b477ad985afc476f4db0312958ba6
SHA5123c49e3209898abb97748f52a058baca95529ae2d0683c63985630f67dcd0c0cafbd9be08a5878637fcf66a9eae77a4f3f7bcbe4c01be18fa95576e5e98e14806
-
Filesize
1.6MB
MD542544e9d2b83639072fe33e42c0a0411
SHA12b6a2e7fce0f48d2e579407924bb422f79941436
SHA256d27cdf9e6a3fc577e60af577cedcf752ba2595fcd18248ffb247b6f98669a3f9
SHA512aa3b885be7af085407fa2fb011d87a465653eca64871548718a82750cacb8e9f310f88516a09404ecc3c940101fdc15bff02a2682dd5efcbe30cdb131939b2c3
-
Filesize
704KB
MD570ecad88d933fe161f1ec6b740711236
SHA187e0d68fd00969cff1d81cd7bb10a1604886c9d2
SHA256a71f11dfb564b7bcab63bd491a0819f6287cb9b0ef4287af22de7c39dd406314
SHA51276e2954158127aef6454eab2628f36abe5c0bf265b0872938a0e3dc25b6da080e919c531533230e94c62b8b8b4a2e2dfd22a411e4ba3e7ba5d3cccb2a3d7665d
-
Filesize
3KB
MD5db72801005a81a695cad9935a0f01bbb
SHA1ea224d8ae4a1e7b91e0ba90309fc31335a1e4cfe
SHA25691ad3f179a98507a4f10c084b95b87812b795ea829758353970c172d204bdc1a
SHA5121acaa882bc2a8dd6f23f132df0ae028f8ea2ff85c5a2143d191d95134b46ef15d74ec90ced8dcfbaffde57089c62e54de328cc6135102c2af3c55ba8c88d0927
-
Filesize
4KB
MD56229d396f5eac038e4f2b733b01cf2e3
SHA143853f0cdc3ad742f8c958544560d2abb61b77b8
SHA25693e044a7a469739c7d96b2cbf04593b5d5f634ea980ced3a27f2cfdd3dd0491a
SHA5128e7b482f04905316ee519263bafd9cf8e731809d4476186e2aba1b4f13c2e33d51c1333de6500bffb6702c7f42df4ff1391988cc9f19b2c2055418ea104c8fa9
-
Filesize
2KB
MD55b0cc6298b2c6f495ca169afd7ea6ad9
SHA153845c73456c9758b1473bc3b4f0b2ef392a750c
SHA256667134c39fd1e2903d8a7ecdba77f998998bf346f39c2dd6010b04950df08ef4
SHA5123034a51ab233f2e499409117546a7bc7058e0af93838248f4796e93f72816d695f9063e3609a808f753d4b2e5624016ce24a7153b91561cc4f58c9ea4a1d9465
-
Filesize
1KB
MD52cbf79a98fbac6b236018c5249f87b4c
SHA1ca5c8149c6ae76f22b0e9f45a02035b10a04caa0
SHA2562b4ae27e95e7d30c197a709e1a3f784b4ee640e731e1944bc371647fb9d41dbe
SHA51231a6b93672d3fbbd096feb174e9506c3f459e3928ff8c3b493380639dd2f6721aefe5cfa3732ccf2e6242cc9978bf02480cab29198eef0fbbe9798b822cfce5e
-
Filesize
212KB
MD5b65427323350e8f21e50081ecf03987e
SHA107be7f355a4d6383880e23bf83eee21d8897715b
SHA2563d77377ed8f959598d211aaab147bc5b7d4e33fd3b24492b5d3b911ff197e17a
SHA51251ba46989c360bb7c5d617124b12ecdd46e6f85b7316f6179d7b7c772c7233101273cd4732eba0b30198cf8ef81c717d465e35462417616342c352cda654729a