b5fe8b8be1ae8d3777d176ecee293395d453a85165a9677d5c7ab78722a5ba78

Analysis

max time kernel
148s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

023aa5b7c33a7e7c9fac32271737c756.exe
Size

14KB
MD5

023aa5b7c33a7e7c9fac32271737c756
SHA1

e7e985c8eb5cd611aa4bea4c4fb5d92c2ba1f93e
SHA256

b5fe8b8be1ae8d3777d176ecee293395d453a85165a9677d5c7ab78722a5ba78
SHA512

3d0ca826ec509f794ac171b7edbbe43ed9e221574a37e05f78dd14632e7669c6a66e1c23da0a04e5e64696c7fe26f6a15fc131e92f96352944d6c477089394a2
SSDEEP

192:K4wTk3/PgHM5Vjd6pK3Nql+iA4vQdXdlCB7C5Hfj6uRzCCBTdMqg/alaj2qxOePx:KA33wMvKKdrha7avCdqVlq2nABu

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2340	023aa5b7c33a7e7c9fac32271737c756.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\WSockDrv32 = "C:\\Windows\\WSockDrv32.exe"	023aa5b7c33a7e7c9fac32271737c756.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WSockDrv32.dll	023aa5b7c33a7e7c9fac32271737c756.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\WSockDrv32.exe	023aa5b7c33a7e7c9fac32271737c756.exe
File opened for modification	C:\Windows\WSockDrv32.exe	023aa5b7c33a7e7c9fac32271737c756.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2340	023aa5b7c33a7e7c9fac32271737c756.exe
2340	023aa5b7c33a7e7c9fac32271737c756.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2340	023aa5b7c33a7e7c9fac32271737c756.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1340	2340	023aa5b7c33a7e7c9fac32271737c756.exe	6
PID 2340 wrote to memory of 1340	2340	023aa5b7c33a7e7c9fac32271737c756.exe	6

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1340
- C:\Users\Admin\AppData\Local\Temp\023aa5b7c33a7e7c9fac32271737c756.exe
  "C:\Users\Admin\AppData\Local\Temp\023aa5b7c33a7e7c9fac32271737c756.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\WSockDrv32.dll

Filesize
120KB

MD5
7bec43b59d617c340e63de3f7c666b6d

SHA1
b368cc798f4432f3ee4da0b0c04f29e452727ac9

SHA256
9bb517e4e756bcb27da630ea859ab54f78224bc0f63290bcb83b70f42a91959f

SHA512
278980b8ca215a08e977873f620f2f7f5eeeb05fa18564c3e69a3be53eeccb9030403440f08694c1a7d77f522082244e18bad64ed8c4bc291d366fc3e5f796ea

Download Submit
memory/1340-10-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/1340-6-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/1340-3-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/2340-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2340-13-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2340-14-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download