a4a6eaa1affd1edc04c624aea49e517cdaad3453535c6f2213610bb7224836cb

Analysis

max time kernel
138s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89492116149f764224766a6d7a8782a3.exe
Size

430KB
MD5

89492116149f764224766a6d7a8782a3
SHA1

da9883f8d4860ba35a3af68d97537fec30770391
SHA256

a4a6eaa1affd1edc04c624aea49e517cdaad3453535c6f2213610bb7224836cb
SHA512

8880888453f66bc70f88882cb02bd1c6f9a84283572ab9031403369f63c10f42b0dbd6f51aa5679c0eda099b018cc5b174296800767d03061b9ca1716c6092e9
SSDEEP

12288:ibee0PGl89WazvzkmMxM+ltxQMAn0Iv1b70ZSf2o:2edGBazvZMHltxtIv1bUS+o

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Winder.lnk	89492116149f764224766a6d7a8782a3.exe

Loads dropped DLL 1 IoCs

pid	Process
2612	89492116149f764224766a6d7a8782a3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\89492116149f764224766a6d7a8782a3.exe = "C:\\System32\\89492116149f764224766a6d7a8782a3.exe"	89492116149f764224766a6d7a8782a3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2612	89492116149f764224766a6d7a8782a3.exe
2612	89492116149f764224766a6d7a8782a3.exe
2612	89492116149f764224766a6d7a8782a3.exe
2612	89492116149f764224766a6d7a8782a3.exe
2612	89492116149f764224766a6d7a8782a3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2612	89492116149f764224766a6d7a8782a3.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2612	89492116149f764224766a6d7a8782a3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2612	89492116149f764224766a6d7a8782a3.exe
2612	89492116149f764224766a6d7a8782a3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2864	2612	89492116149f764224766a6d7a8782a3.exe	28
PID 2612 wrote to memory of 2864	2612	89492116149f764224766a6d7a8782a3.exe	28
PID 2612 wrote to memory of 2864	2612	89492116149f764224766a6d7a8782a3.exe	28
PID 2612 wrote to memory of 2864	2612	89492116149f764224766a6d7a8782a3.exe	28

C:\Users\Admin\AppData\Local\Temp\89492116149f764224766a6d7a8782a3.exe
"C:\Users\Admin\AppData\Local\Temp\89492116149f764224766a6d7a8782a3.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS1.vbs"
  2⤵
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS1.vbs

Filesize
653B

MD5
837eadcbc310df9bbf469a3b72380c68

SHA1
4bd810ea909f4fc9cd79d352f950398c263b7af6

SHA256
b9f01b1329e96a4a6bac02c60ab700d3bd6bf08ee2827e990bfb30b41793d113

SHA512
699137b8cf29c5085a9bd8d2dcbd088eac53e0c7bfe7f0d1f0f594a37ccdea62669deea8cb3a8abd9633bc6498d0818664d1e236cf553345888455f46caab8bc

Download Submit
\System32\89492116149f764224766a6d7a8782a3.exe

Filesize
430KB

MD5
49668e6d248e51ddd6c41cf5a62ef2e8

SHA1
629f85129bcbfbdae451d932b483e73297e109a0

SHA256
bc5aedb0c31b029314ba93ba64c149e52d226e1a258c4d0819f09ac0be9b526b

SHA512
c1a08bae61e3286dcee0959555978d4abe976bfec1662f40451e7dcfb4c7432a0cdc04e0d882871ef21dbb5ea60f9c8a1a814018a75bec12d136466dd875b22d

Download Submit
memory/2612-0-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2612-5-0x0000000001D50000-0x0000000001D60000-memory.dmp

Filesize
64KB

Download
memory/2612-13-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2612-14-0x0000000001D50000-0x0000000001D60000-memory.dmp

Filesize
64KB

Download