5bf96b019b044bfee4187442eac645547942ab2708229019ecbb1a842690322a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11b934e4667d67a730918c398f2a29b3.exe
Size

212KB
MD5

11b934e4667d67a730918c398f2a29b3
SHA1

dfc2f0e780c77590193860361256b74f2bb5e863
SHA256

5bf96b019b044bfee4187442eac645547942ab2708229019ecbb1a842690322a
SHA512

36f5f5f0bcffd917bd8559cb6072ebbe9677ab577120c080cff2ad5f5b9b402dc22924cf1551be7521a75709ef61482821c545edb35e2638e8f928eb007db0e7
SSDEEP

3072:+RKiAuTAIv1mVB9ete1HxGcQ7CoLRxRsNDsq8igbrVq6L6VksY3wiJ6rULAaMobL:Gxv0L9BH8Z7hFUDh8i6bEiJU

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2748	snjegovic.exe
2548	iexplorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\iexplorer.exe"	iexplorer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\iexplorer.exe	snjegovic.exe
File opened for modification	C:\Windows\iexplorer.exe	snjegovic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	iexplorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2548	iexplorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2748	2452	11b934e4667d67a730918c398f2a29b3.exe	18
PID 2452 wrote to memory of 2748	2452	11b934e4667d67a730918c398f2a29b3.exe	18
PID 2452 wrote to memory of 2748	2452	11b934e4667d67a730918c398f2a29b3.exe	18
PID 2748 wrote to memory of 2548	2748	snjegovic.exe	19
PID 2748 wrote to memory of 2548	2748	snjegovic.exe	19
PID 2748 wrote to memory of 2548	2748	snjegovic.exe	19

C:\Users\Admin\AppData\Local\Temp\11b934e4667d67a730918c398f2a29b3.exe
"C:\Users\Admin\AppData\Local\Temp\11b934e4667d67a730918c398f2a29b3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Roaming\snjegovic.exe
  "C:\Users\Admin\AppData\Roaming\snjegovic.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\iexplorer.exe
    "C:\Windows\iexplorer.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\snjegovic.exe

Filesize
37KB

MD5
cbe484d973d810efcff8d64709a6089f

SHA1
5c56b8ca05618e85f04532a73ac0b2ea79546076

SHA256
bc344ca5da80942cc58c241ddb7d5dcf5958c84e2bfe7df69b0ac5460fd856b2

SHA512
02b32ea6aad22ce2800bccceb4aa518570dbeae00e77619394dd6879e69314a32682ab14f3ae6d5d2a960329190b250d9bad06e1fa39311538d6c38f40960dd7

Download Submit
memory/2452-10-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/2452-3-0x0000000001EB0000-0x0000000001F30000-memory.dmp

Filesize
512KB

Download
memory/2452-2-0x00000000022E0000-0x00000000022F0000-memory.dmp

Filesize
64KB

Download
memory/2452-11-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/2452-1-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/2548-26-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/2548-23-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/2548-25-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/2748-15-0x00000000002E0000-0x0000000000360000-memory.dmp

Filesize
512KB

Download
memory/2748-13-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/2748-24-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/2748-14-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads