77f9b0c7e54abbcfdc08c48cfa35cc2fb3ed66f24ad5b694942f92f8d56dc84c

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

115262c95fca255228729fb13b1c06fb.exe
Size

110KB
MD5

115262c95fca255228729fb13b1c06fb
SHA1

9ba6a1df4c7faf6547b931c9e43852e70c372ec7
SHA256

77f9b0c7e54abbcfdc08c48cfa35cc2fb3ed66f24ad5b694942f92f8d56dc84c
SHA512

22dde974fe3c94ba52b72e5c5041134efbf31fe6a8e407f5c78540b27745f1ce1a7aab48e3a3fbeb85f09b863334b4c5f99307a471835dbbbb26e912c6b124d5
SSDEEP

3072:WNyah0mJ8VNVoRtmzUw06VyTBQNmHqfILEST:WwPVNi6h0NdQNHfLw

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2152	matrix322614.exe

Loads dropped DLL 8 IoCs

pid	Process
2088	115262c95fca255228729fb13b1c06fb.exe
2088	115262c95fca255228729fb13b1c06fb.exe
2152	matrix322614.exe
2152	matrix322614.exe
2152	matrix322614.exe
2404	WerFault.exe
2404	WerFault.exe
2404	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2404	2152	WerFault.exe	28

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2152	2088	115262c95fca255228729fb13b1c06fb.exe	28
PID 2088 wrote to memory of 2152	2088	115262c95fca255228729fb13b1c06fb.exe	28
PID 2088 wrote to memory of 2152	2088	115262c95fca255228729fb13b1c06fb.exe	28
PID 2088 wrote to memory of 2152	2088	115262c95fca255228729fb13b1c06fb.exe	28
PID 2088 wrote to memory of 2152	2088	115262c95fca255228729fb13b1c06fb.exe	28
PID 2088 wrote to memory of 2152	2088	115262c95fca255228729fb13b1c06fb.exe	28
PID 2088 wrote to memory of 2152	2088	115262c95fca255228729fb13b1c06fb.exe	28
PID 2152 wrote to memory of 2404	2152	matrix322614.exe	29
PID 2152 wrote to memory of 2404	2152	matrix322614.exe	29
PID 2152 wrote to memory of 2404	2152	matrix322614.exe	29
PID 2152 wrote to memory of 2404	2152	matrix322614.exe	29
PID 2152 wrote to memory of 2404	2152	matrix322614.exe	29
PID 2152 wrote to memory of 2404	2152	matrix322614.exe	29
PID 2152 wrote to memory of 2404	2152	matrix322614.exe	29

C:\Users\Admin\AppData\Local\Temp\115262c95fca255228729fb13b1c06fb.exe
"C:\Users\Admin\AppData\Local\Temp\115262c95fca255228729fb13b1c06fb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\matrix322614.exe
  C:\Users\Admin\AppData\Local\Temp\matrix322614.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 252
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\matrix322614.exe

Filesize
64KB

MD5
2e6ee751c89a44282b0f6e51c2169dc3

SHA1
5d4ecc7cfbec5822860ea466abd80859247ac6f0

SHA256
4e259443072290d6c71add18e03199f4c4ba26a351d74f505cdb64f83507688e

SHA512
6b3cbd805648202cd6f6b44c8286e8257b20f0d9fd28b84e96e54a434ffc5c3e0e5a961c0548016a3450a39d40da45eb2a49483658f1cc558e0cbe4f01575cd3

Download Submit
memory/2152-14-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download