cfb3a2949efa2f947ea5253d4078593649262917c134dbf4e602b3807315295b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c882c00c3e4516b850ada03ef338949b.exe
Size

124KB
MD5

c882c00c3e4516b850ada03ef338949b
SHA1

1b88723ac7b8554f7fc519d4aed1af8dd03ac399
SHA256

cfb3a2949efa2f947ea5253d4078593649262917c134dbf4e602b3807315295b
SHA512

2ea775f81886231b4d2e4907f5d8495d10592843d0a7d1bbc9747ebf5e844d2c706c593367447a045407a9ea0f6cd0a2ade666d6cf39776e61271f7d001aa1a6
SSDEEP

1536:RaXTpbUsN2yajc8m/IZ9uSSu8SmJTQSwZ9umiu/6o88qXUlF8E:8lbUpgZ/INSuNmJTQSaMm5/6PDUlp

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\demzxmbcng.sys	ScriptDetectorhandler.exe

Executes dropped EXE 2 IoCs

pid	Process
2104	ScriptDetectorhandler..exe
2268	ScriptDetectorhandler.exe

Loads dropped DLL 3 IoCs

pid	Process
2512	c882c00c3e4516b850ada03ef338949b.exe
2512	c882c00c3e4516b850ada03ef338949b.exe
2720	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2512	c882c00c3e4516b850ada03ef338949b.exe
2104	ScriptDetectorhandler..exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2104	2512	c882c00c3e4516b850ada03ef338949b.exe	28
PID 2512 wrote to memory of 2104	2512	c882c00c3e4516b850ada03ef338949b.exe	28
PID 2512 wrote to memory of 2104	2512	c882c00c3e4516b850ada03ef338949b.exe	28
PID 2512 wrote to memory of 2104	2512	c882c00c3e4516b850ada03ef338949b.exe	28
PID 2512 wrote to memory of 2268	2512	c882c00c3e4516b850ada03ef338949b.exe	29
PID 2512 wrote to memory of 2268	2512	c882c00c3e4516b850ada03ef338949b.exe	29
PID 2512 wrote to memory of 2268	2512	c882c00c3e4516b850ada03ef338949b.exe	29
PID 2512 wrote to memory of 2268	2512	c882c00c3e4516b850ada03ef338949b.exe	29

C:\Users\Admin\AppData\Local\Temp\c882c00c3e4516b850ada03ef338949b.exe
"C:\Users\Admin\AppData\Local\Temp\c882c00c3e4516b850ada03ef338949b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\ScriptDetectorhandler..exe
  "C:\Users\Admin\AppData\Local\Temp\ScriptDetectorhandler..exe" 0
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2104
- C:\Users\Admin\AppData\Local\Temp\ScriptDetectorhandler.exe
  "C:\Users\Admin\AppData\Local\Temp\ScriptDetectorhandler.exe" 0
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\ScriptDetectorhandler..exe

Filesize
11KB

MD5
b96dfc00e83b1ce5aec85b006ac3f249

SHA1
8692a7945c87ee80a1920689287cef1f0e42b62b

SHA256
78ea738a5bc4703922a6068af43572e7073dee2fa297be94955fcd6cc065785a

SHA512
4223309b031216736f3693aad8bc5d1c1afcbca643c62df5e724d32fcd491d36c764d270e49cb60bb336f2e63d8313c1096826d08de9892769465c7540cca275

Download Submit
\Users\Admin\AppData\Local\Temp\ScriptDetectorhandler.exe

Filesize
103KB

MD5
fe5fa7727357069b052d0b8217d71f3e

SHA1
27aab1252c905894e465efe963d803aa4b78db00

SHA256
f4522fb78990d89e602d821912ff7052d7f8f07cd9aa478b8532d70e71081b28

SHA512
b7e615910eefd239775a8e79cfd85f328a029b9cce6472b2b7bb0e406ec46efb306a31622522940c1f344f0dd73314153849252e17c6c5436524501d2537532d

Download Submit