b86dbf9c4f9cc00245d189a04dafa91cdfe40810fe6357ceda6b9b624b037c5d

Analysis

max time kernel
133s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 07:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

testsample.exe
Size

44KB
MD5

fa6449ea6f25f0355d4ba80213a2221c
SHA1

25d22abec0bdd16ca92c632d5409f9fdddc85af2
SHA256

b86dbf9c4f9cc00245d189a04dafa91cdfe40810fe6357ceda6b9b624b037c5d
SHA512

e212f1597079a7b2ca92bd926a32148a911a23bafb9f1646ae288b2abee60cb3eb61d6f599d5573a83d1126b154725385721b37db17d4c71d9b663e8223bf55c
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37YlNCuE:bgGYcA/53GAA6y37QRE

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3040	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2304	testsample.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 3040	2304	testsample.exe	28
PID 2304 wrote to memory of 3040	2304	testsample.exe	28
PID 2304 wrote to memory of 3040	2304	testsample.exe	28
PID 2304 wrote to memory of 3040	2304	testsample.exe	28

C:\Users\Admin\AppData\Local\Temp\testsample.exe
"C:\Users\Admin\AppData\Local\Temp\testsample.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
44KB

MD5
309f5da721508655d2096db21f851fb5

SHA1
feccd7935666bcd70bf76b7b760c6e6975e51699

SHA256
f7a0d3562f0f2d54a52c5596df3170572a621f798e5323666ecda5d37da76063

SHA512
4c8864451f0b4946ba9337be042a3b063116fd15b8215acaaf2e0a88d7fdd72d01d3fa3b8acbf9a1bf6fea3c0e7420e3e526db99fb64437b394f5633ee637b7d

Download Submit
memory/2304-0-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2304-1-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2304-8-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/3040-15-0x0000000001CA0000-0x0000000001CA6000-memory.dmp

Filesize
24KB

Download
memory/3040-16-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download