b5fe8b8be1ae8d3777d176ecee293395d453a85165a9677d5c7ab78722a5ba78

Analysis

max time kernel
149s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

023aa5b7c33a7e7c9fac32271737c756.exe
Size

14KB
MD5

023aa5b7c33a7e7c9fac32271737c756
SHA1

e7e985c8eb5cd611aa4bea4c4fb5d92c2ba1f93e
SHA256

b5fe8b8be1ae8d3777d176ecee293395d453a85165a9677d5c7ab78722a5ba78
SHA512

3d0ca826ec509f794ac171b7edbbe43ed9e221574a37e05f78dd14632e7669c6a66e1c23da0a04e5e64696c7fe26f6a15fc131e92f96352944d6c477089394a2
SSDEEP

192:K4wTk3/PgHM5Vjd6pK3Nql+iA4vQdXdlCB7C5Hfj6uRzCCBTdMqg/alaj2qxOePx:KA33wMvKKdrha7avCdqVlq2nABu

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
216	023aa5b7c33a7e7c9fac32271737c756.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WSockDrv32 = "C:\\Windows\\WSockDrv32.exe"	023aa5b7c33a7e7c9fac32271737c756.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WSockDrv32.dll	023aa5b7c33a7e7c9fac32271737c756.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\WSockDrv32.exe	023aa5b7c33a7e7c9fac32271737c756.exe
File opened for modification	C:\Windows\WSockDrv32.exe	023aa5b7c33a7e7c9fac32271737c756.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
216	023aa5b7c33a7e7c9fac32271737c756.exe
216	023aa5b7c33a7e7c9fac32271737c756.exe
216	023aa5b7c33a7e7c9fac32271737c756.exe
216	023aa5b7c33a7e7c9fac32271737c756.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
216	023aa5b7c33a7e7c9fac32271737c756.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 3468	216	023aa5b7c33a7e7c9fac32271737c756.exe	50
PID 216 wrote to memory of 3468	216	023aa5b7c33a7e7c9fac32271737c756.exe	50

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3468
- C:\Users\Admin\AppData\Local\Temp\023aa5b7c33a7e7c9fac32271737c756.exe
  "C:\Users\Admin\AppData\Local\Temp\023aa5b7c33a7e7c9fac32271737c756.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\WSockDrv32.dll

Filesize
124KB

MD5
f59e5c2d9e241b24f54763fcabc82756

SHA1
f404c4abbbe57cba1b41bb11df46daf932f9d709

SHA256
57e395e5b02ecbd3d7dd9066d5f23ebc14b1c8a84f8f918e592a04d4cffaf924

SHA512
0dfd15a0e4a411330e7cc90639ff6a5442403b2aba756ec3c7a4e973aa87a2e225ff34bded3dc4a7245b398e257c44d1e089d9af66259fd2548f063bc7ee2bb4

Download Submit
memory/216-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/216-5-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/216-9-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/3468-3-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download