e32af43baf71d9e5ee809750ca678fdc32947665c98641d8b62f9b8424fe66a4

Analysis

max time kernel
142s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03e9a01a9dce98e579092938292ca855.exe
Size

45KB
MD5

03e9a01a9dce98e579092938292ca855
SHA1

930c3f0bd1c3cad231dcdfd55f91a13d31785dad
SHA256

e32af43baf71d9e5ee809750ca678fdc32947665c98641d8b62f9b8424fe66a4
SHA512

638289347964e1291f13c47a499cf605317295137820e5b88e2e4899ff1fcd5c5c956a7da147c7195cffc0f0c3910777af4c944e677c100a73df4871e7b82f0a
SSDEEP

768:NiOQauOECLIK8u4qc+5aIjK4LrP+K5fE67y7N8FdUV0MeEBfz:Nip8JB5aOLL+K5E6U878pz

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FSMA32 = "C:\\Windows\\I6dcQbmRAuEd.exe"	03e9a01a9dce98e579092938292ca855.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\I6dcQbmRAuEd.exe	03e9a01a9dce98e579092938292ca855.exe
File opened for modification	C:\Windows\I6dcQbmRAuEd.exe	03e9a01a9dce98e579092938292ca855.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2564	2228	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2564	2228	03e9a01a9dce98e579092938292ca855.exe	30
PID 2228 wrote to memory of 2564	2228	03e9a01a9dce98e579092938292ca855.exe	30
PID 2228 wrote to memory of 2564	2228	03e9a01a9dce98e579092938292ca855.exe	30
PID 2228 wrote to memory of 2564	2228	03e9a01a9dce98e579092938292ca855.exe	30

C:\Users\Admin\AppData\Local\Temp\03e9a01a9dce98e579092938292ca855.exe
"C:\Users\Admin\AppData\Local\Temp\03e9a01a9dce98e579092938292ca855.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1564
  2⤵
  - Program crash
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2228-3-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2228-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2228-7-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads