Analysis
-
max time kernel
142s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
25-12-2023 22:52
General
-
Target
41797794e9727e3ab0b7ecdc8a8f804d.exe
-
Size
4.8MB
-
MD5
41797794e9727e3ab0b7ecdc8a8f804d
-
SHA1
9a80fb84ebcc3bd1500394254cb553bd23e397d0
-
SHA256
b98e26e7f20370266127bb174027ac529ed6029ce410a51e0f75ee4b0d3bb0f4
-
SHA512
aa2c0d810b3977084d6833291715d28b515b4e4ebd6757721217b834a6194e1d620ae938e917e211394cb8209a7ad57dc91f68ff817312de30296cabf3de4972
-
SSDEEP
98304:PX4ouvgkswFADRHW6RET61GjbtCnkwPh69uvGDxSmtQeyXudKr3Eyazx14:vX4zFADde+1Gvte5P09uvwkpedKIya0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 7 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 23 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\41797794e9727e3ab0b7ecdc8a8f804d.exe"C:\Users\Admin\AppData\Local\Temp\41797794e9727e3ab0b7ecdc8a8f804d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-IAC79.tmp\41797794e9727e3ab0b7ecdc8a8f804d.tmp"C:\Users\Admin\AppData\Local\Temp\is-IAC79.tmp\41797794e9727e3ab0b7ecdc8a8f804d.tmp" /SL5="$30142,4345138,721408,C:\Users\Admin\AppData\Local\Temp\41797794e9727e3ab0b7ecdc8a8f804d.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Aut\iusto\Porro.exe"C:\Program Files (x86)\Aut/\iusto\Porro.exe" c804188eab29f5f1667ff06a13fe37803⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 4964⤵
- Loads dropped DLL
- Program crash
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5ea98a4041fd44572e2b42550878b4b97
SHA1b193c81d784d52b2c4e7b3ed1a71d9eefab4f50f
SHA256a2fac310df70f48069976c76816b4bb36f29f1fabf5c9c031f7666607658eabd
SHA512e0472c18ada339b4f7f1c0f90795bb98664419c4b1b59a1ac1ac892ba626c9412ebc1d0b5bf8b1659a377446836a3aeaf854dc677c79f0f69d999b5187916bd9
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
19.0MB
-
Filesize
4KB
-
Filesize
19.0MB
-
Filesize
19.0MB
-
Filesize
4KB
-
Filesize
2.5MB
-
Filesize
4KB