Overview

overview

10

Static

static

3

15b4720ea2...e8.exe

windows7-x64

10

15b4720ea2...e8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    253s
  • max time network
    173s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 10:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    15b4720ea2d529fcb6c602fc095d8fe8.exe

  • Size

    31KB

  • MD5

    15b4720ea2d529fcb6c602fc095d8fe8

  • SHA1

    cdd06854b64f775f58ae78e813de4938b776b0dd

  • SHA256

    c251a0e7178fd23897921382e528bcb7e477888901f2d3e9d66584e827e3efa1

  • SHA512

    12af4a59ea5c136e0ee8514f7cf345d4a797082420527778188518e63b9d11f9329293dfdbc4ca77070f5e7172a667db1ab4993eed20dbaed7259585a3ea7bd0

  • SSDEEP

    768:39j3dfwZCyv5uGDVWl8zHPHXyXHCzcHHvzQBdi9vc:39CCE7VWl4vUv4Wvc

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15b4720ea2d529fcb6c602fc095d8fe8.exe
    "C:\Users\Admin\AppData\Local\Temp\15b4720ea2d529fcb6c602fc095d8fe8.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Users\Admin\Admin.exe
      "C:\Users\Admin\Admin.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:340

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\Admin.exe
          Filesize

          31KB

          MD5

          52e02a342961a717d160536a238ce39e

          SHA1

          b91d272990f368e9e7d41c43238bfa12fb938602

          SHA256

          636995649c3c506a26f284c914fe3755946a2cbead88103a50bd3bb6ad76e096

          SHA512

          66accfa74cd63a68dfc442ff18f643d757947773e3afa32750689f34c52ba1a9904817afa9d562ec6a0be9dffdaaf1210a262097a97ab936de9ca7203a411263

          Download Submit

        • memory/340-13-0x0000000000400000-0x000000000040C000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2748-0-0x0000000000400000-0x000000000040C000-memory.dmp

          Filesize

          48KB

          Download