09b4c8ad7f0b0a651b468b8affb53d70db6c3b62c6fd4d69ef87b0da0d73af82

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06350c1961ee8dad1cc353ed628d81fb.exe
Size

886KB
MD5

06350c1961ee8dad1cc353ed628d81fb
SHA1

36c95c5df63617ed37eacbdf658ee35f2552a22e
SHA256

09b4c8ad7f0b0a651b468b8affb53d70db6c3b62c6fd4d69ef87b0da0d73af82
SHA512

534f1e5aeb26766e3f73bda925baf508169a974997e79571c20f53871f78ead1328e37de250007dac3172d121e599b9c1d28fe6ecfe9ef32eccfcc7698830442
SSDEEP

24576:z6rT0bp8iVtGVcG9pV1OqVtFnSQT3mC7npsTU4jmg:zC0bVG9BSIxpsTwg

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2468	2020	06350c1961ee8dad1cc353ed628d81fb.exe	28
PID 2020 wrote to memory of 2468	2020	06350c1961ee8dad1cc353ed628d81fb.exe	28
PID 2020 wrote to memory of 2468	2020	06350c1961ee8dad1cc353ed628d81fb.exe	28
PID 2020 wrote to memory of 2468	2020	06350c1961ee8dad1cc353ed628d81fb.exe	28
PID 2468 wrote to memory of 2696	2468	mshta.exe	29
PID 2468 wrote to memory of 2696	2468	mshta.exe	29
PID 2468 wrote to memory of 2696	2468	mshta.exe	29
PID 2468 wrote to memory of 2696	2468	mshta.exe	29
PID 2696 wrote to memory of 2736	2696	cmd.exe	31
PID 2696 wrote to memory of 2736	2696	cmd.exe	31
PID 2696 wrote to memory of 2736	2696	cmd.exe	31
PID 2696 wrote to memory of 2736	2696	cmd.exe	31
PID 2696 wrote to memory of 2764	2696	cmd.exe	32
PID 2696 wrote to memory of 2764	2696	cmd.exe	32
PID 2696 wrote to memory of 2764	2696	cmd.exe	32
PID 2696 wrote to memory of 2764	2696	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\06350c1961ee8dad1cc353ed628d81fb.exe
"C:\Users\Admin\AppData\Local\Temp\06350c1961ee8dad1cc353ed628d81fb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" "javascript:new ActiveXObject('WScript.Shell').Run('SOLA_2.0_23169307684331.bat',0);window.close()"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\SOLA_2.0_23169307684331.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c date /t
      4⤵
      PID:2736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c dir C:\Windows\explorer.exe
      4⤵
      PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SOLA_2.0_23169307684331.bat

Filesize
10KB

MD5
a8739fbe63e756796622682d1306df51

SHA1
4e43a1ed3d45353a2dff612ae5d9df8fa7b00597

SHA256
c7ff9ea3361629f293de3673a89b60826090b64bc4eaab3dc9e2c9878968966e

SHA512
9ce20dbb0a2987d5bcc38940b8c82752f37b09cb9c64c4adba6d31699bd616a5f5c0612c73fc3d9e96a71924525483736cba0dd3577d580e3f4a06146c453bdc

Download Submit
memory/2020-7-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download