Analysis

  • max time kernel
    60s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 08:38

General

  • Target

    605c35366b7c51d33746d7173b9a5169.exe

  • Size

    1.1MB

  • MD5

    605c35366b7c51d33746d7173b9a5169

  • SHA1

    f75fb8bb1b086ad55461ab18227d35811b4cc5d6

  • SHA256

    4a67899d740ecd593679a000e4fd663474307306640d8862a2d986ba4ce3b189

  • SHA512

    1459976dbc4fc81ace18c90e87cf39149971ed1e796c4e2997e1cb760d7dd299bad8bbef53c6ae7e6ee67e38dcb94c6768e1f7469b0890c28e48f4450c50f5f6

  • SSDEEP

    24576:IxVxBeKif9i/ylluneUyxcaMep/ahpka:I/xBfyPfuneP1Mepy

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

Processes

  • C:\Users\Admin\AppData\Local\Temp\605c35366b7c51d33746d7173b9a5169.exe
    "C:\Users\Admin\AppData\Local\Temp\605c35366b7c51d33746d7173b9a5169.exe"
    1⤵
      PID:1680
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        2⤵
          PID:2896
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks.exe" /create /f /tn "LAN Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8B9.tmp"
            3⤵
            • Creates scheduled task(s)
            PID:1568
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks.exe" /create /f /tn "LAN Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp879.tmp"
            3⤵
            • Creates scheduled task(s)
            PID:320
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sjxNYmz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp751.tmp"
          2⤵
          • Creates scheduled task(s)
          PID:3036

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1680-28-0x0000000073FC0000-0x00000000746AE000-memory.dmp

              Filesize

              6.9MB

            • memory/1680-0-0x0000000000FE0000-0x00000000010FE000-memory.dmp

              Filesize

              1.1MB

            • memory/1680-2-0x0000000004820000-0x0000000004860000-memory.dmp

              Filesize

              256KB

            • memory/1680-3-0x00000000004E0000-0x0000000000502000-memory.dmp

              Filesize

              136KB

            • memory/1680-4-0x0000000073FC0000-0x00000000746AE000-memory.dmp

              Filesize

              6.9MB

            • memory/1680-5-0x0000000004820000-0x0000000004860000-memory.dmp

              Filesize

              256KB

            • memory/1680-6-0x0000000005460000-0x00000000054E2000-memory.dmp

              Filesize

              520KB

            • memory/1680-7-0x0000000000A70000-0x0000000000AAA000-memory.dmp

              Filesize

              232KB

            • memory/1680-1-0x0000000073FC0000-0x00000000746AE000-memory.dmp

              Filesize

              6.9MB

            • memory/2896-39-0x0000000000550000-0x000000000056E000-memory.dmp

              Filesize

              120KB

            • memory/2896-23-0x0000000000400000-0x0000000000438000-memory.dmp

              Filesize

              224KB

            • memory/2896-40-0x0000000000580000-0x000000000058A000-memory.dmp

              Filesize

              40KB

            • memory/2896-29-0x0000000073FC0000-0x00000000746AE000-memory.dmp

              Filesize

              6.9MB

            • memory/2896-38-0x0000000000540000-0x000000000054A000-memory.dmp

              Filesize

              40KB

            • memory/2896-27-0x0000000000400000-0x0000000000438000-memory.dmp

              Filesize

              224KB

            • memory/2896-25-0x0000000000400000-0x0000000000438000-memory.dmp

              Filesize

              224KB

            • memory/2896-30-0x0000000004DA0000-0x0000000004DE0000-memory.dmp

              Filesize

              256KB

            • memory/2896-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/2896-19-0x0000000000400000-0x0000000000438000-memory.dmp

              Filesize

              224KB

            • memory/2896-17-0x0000000000400000-0x0000000000438000-memory.dmp

              Filesize

              224KB

            • memory/2896-15-0x0000000000400000-0x0000000000438000-memory.dmp

              Filesize

              224KB

            • memory/2896-13-0x0000000000400000-0x0000000000438000-memory.dmp

              Filesize

              224KB

            • memory/2896-41-0x0000000073FC0000-0x00000000746AE000-memory.dmp

              Filesize

              6.9MB

            • memory/2896-42-0x0000000004DA0000-0x0000000004DE0000-memory.dmp

              Filesize

              256KB