53330cee9bba3b7648a03a941a072182a1bc616256d4289a8f0f0db9152ec587

Analysis

max time kernel
0s
max time network
130s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0e159016f4e1223bea4164d318677a65.exe
Size

99KB
MD5

0e159016f4e1223bea4164d318677a65
SHA1

71620f4f37856112b07a97c3e6f1920bd33cd49b
SHA256

53330cee9bba3b7648a03a941a072182a1bc616256d4289a8f0f0db9152ec587
SHA512

7374df5592236fec321014c146464486e2b36b78f519ceb6aac771be1582435a984c995b6b6138a97cb6caecb846769befe6f1c23c99a72e434db96f90989e55
SSDEEP

1536:MkcUv9Wrw3h3FA2BJskRMbBLBZCx5ywyTjcol97NKRxWMZvbNV5LtL3HX:1d9xR3G2BZMbBLBaYw0coLujNH1HX

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fullmovies com 1 Affiliate Program for Movie Downloads.LNK	0e159016f4e1223bea4164d318677a65.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Fullmovies com 1 Affiliate Program for Movie Downloads	0e159016f4e1223bea4164d318677a65.exe
File created	C:\Program Files (x86)\Fullmovies com 1 Affiliate Program for Movie Downloads\Icon23062011195418.ico	0e159016f4e1223bea4164d318677a65.exe
File opened for modification	C:\Program Files (x86)\Fullmovies com 1 Affiliate Program for Movie Downloads\Icon23062011195418.ico	0e159016f4e1223bea4164d318677a65.exe
File created	C:\Program Files (x86)\Fullmovies com 1 Affiliate Program for Movie Downloads\Fullmovies com 1 Affiliate Program for Movie Downloads.LNK	0e159016f4e1223bea4164d318677a65.exe
File opened for modification	C:\Program Files (x86)\Fullmovies com 1 Affiliate Program for Movie Downloads\Fullmovies com 1 Affiliate Program for Movie Downloads.LNK	0e159016f4e1223bea4164d318677a65.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1716	1748	0e159016f4e1223bea4164d318677a65.exe	16
PID 1748 wrote to memory of 1716	1748	0e159016f4e1223bea4164d318677a65.exe	16
PID 1748 wrote to memory of 1716	1748	0e159016f4e1223bea4164d318677a65.exe	16
PID 1748 wrote to memory of 1716	1748	0e159016f4e1223bea4164d318677a65.exe	16

C:\Users\Admin\AppData\Local\Temp\0e159016f4e1223bea4164d318677a65.exe
"C:\Users\Admin\AppData\Local\Temp\0e159016f4e1223bea4164d318677a65.exe"
1⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.chrisqueen.com/cb/FULLMOV/program
  2⤵
  PID:1716
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2
    3⤵
    PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1748-19-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download