Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24-12-2023 23:55

General

  • Target

    1b1a115d197506fe367806281b279dc6.exe

  • Size

    703KB

  • MD5

    1b1a115d197506fe367806281b279dc6

  • SHA1

    6c920e35404e12a9b94fdf28d4b8dc692f843fa7

  • SHA256

    6c3b6deb520c98c0efa7968bbec15cd1fb7a60c09f00503d025c97bc0116ca5e

  • SHA512

    22e3b94ff360592625118f94c94df4d37080a0dbbc0f30e27578b6d0b237ac6c9a6bd3cc6a269c195a390320dbe35d1e4f4ef946c5c7847cd368ea07fcdc4aa3

  • SSDEEP

    12288:JDs5xGSWm2AxYi87eTQeOfP6QF8F2Dy7P8F0jpX5zE9r0v1Mkcsf:e5dxTQpTf

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b1a115d197506fe367806281b279dc6.exe
    "C:\Users\Admin\AppData\Local\Temp\1b1a115d197506fe367806281b279dc6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Delegation-Visit.pdf"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:3068
    • C:\Users\Admin\AppData\Local\Postman\svchost.exe
      "C:\Users\Admin\AppData\Local\Postman\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Postman\svchost.exe

    Filesize

    184KB

    MD5

    c578ee4f05158761b90a020b7dc3a4fd

    SHA1

    8167bd66d6b413ca08e04dcc6d2072d8ab11fa55

    SHA256

    7902501e4e1e651774cd5e9e443e1f778214b412ed9b7d0db8df700fd4eb9d4f

    SHA512

    d2f23036ccc8a03770da765c1acdc3b9bfaf8cec16bb06bd61b78be5084830c76824fe0501d7008db43d560355c0ee34158dc8ae318e579932e5bf00ce5ebd68

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    b576c9cc6dae739cebe65932f89d4620

    SHA1

    3fdffc29b24e8093e09880ec9e1ad172f3e7cf36

    SHA256

    5946a59c9b584b4808d702753b40524cbc7c4a797157404058f19270b1989c77

    SHA512

    8b6ef7d1cd59d908b3674b49fa8664bf311b9127981714c09a6a36c713e976179204cce3fec83d6b6ee43c0a3772fc14efe66f6d5989373d04c285d1e0fdcd7a

  • C:\Users\Admin\AppData\Roaming\Delegation-Visit.pdf

    Filesize

    11KB

    MD5

    5dbc7dba0d1d88cc582c77326ad6920c

    SHA1

    5769a36dbf02a160c523ced0556d109503528d86

    SHA256

    a536f802e31bb7ab930d526c79127f61ca2e34469a840e07db4a79e9a2cefc3a

    SHA512

    be50bedf03c7be656a1d5ece7c7bdc6475fdf478ac43935be88983203dea1f3b4217e70d09b9dda92c627784acc39a07c81ceb872f45dc4517a8115f8acb6e44

  • memory/2192-9-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

    Filesize

    9.6MB

  • memory/2192-10-0x0000000002050000-0x00000000020D0000-memory.dmp

    Filesize

    512KB

  • memory/2192-11-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

    Filesize

    9.6MB

  • memory/2192-31-0x0000000002050000-0x00000000020D0000-memory.dmp

    Filesize

    512KB

  • memory/2192-30-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

    Filesize

    9.6MB

  • memory/2924-0-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

    Filesize

    9.6MB

  • memory/2924-1-0x0000000002190000-0x0000000002210000-memory.dmp

    Filesize

    512KB

  • memory/2924-8-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

    Filesize

    9.6MB