fddf222eb86fc770f1f45996cd1a875a87a69c54c3f1760a706f1c70498c93e2

Analysis

max time kernel
122s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e003954447b1fd20f1c8b70843bbf89.exe
Size

1.2MB
MD5

1e003954447b1fd20f1c8b70843bbf89
SHA1

ca976064e4574da2fafa2d18fe9304dd466358b9
SHA256

fddf222eb86fc770f1f45996cd1a875a87a69c54c3f1760a706f1c70498c93e2
SHA512

8cd6626f40e57f453ea1ebacfac36dbae2621ff8db97865b39bf69a5a96190f8eb46f7f04bdbc2a521953484ec8b11a39583a9731b0da750d844dcd0eb102e8e
SSDEEP

24576:z6rTrbp8iVtGVcG9pV1OqVtFnSQT3m6rTtbp8iVtGVcG9pV1OqVtXnSQT0m:zCrbVG9BSIWCtbVG9rSIl

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2716	3044	1e003954447b1fd20f1c8b70843bbf89.exe	28
PID 3044 wrote to memory of 2716	3044	1e003954447b1fd20f1c8b70843bbf89.exe	28
PID 3044 wrote to memory of 2716	3044	1e003954447b1fd20f1c8b70843bbf89.exe	28
PID 3044 wrote to memory of 2716	3044	1e003954447b1fd20f1c8b70843bbf89.exe	28
PID 2716 wrote to memory of 2636	2716	mshta.exe	29
PID 2716 wrote to memory of 2636	2716	mshta.exe	29
PID 2716 wrote to memory of 2636	2716	mshta.exe	29
PID 2716 wrote to memory of 2636	2716	mshta.exe	29
PID 2636 wrote to memory of 2584	2636	cmd.exe	31
PID 2636 wrote to memory of 2584	2636	cmd.exe	31
PID 2636 wrote to memory of 2584	2636	cmd.exe	31
PID 2636 wrote to memory of 2584	2636	cmd.exe	31
PID 2636 wrote to memory of 2604	2636	cmd.exe	32
PID 2636 wrote to memory of 2604	2636	cmd.exe	32
PID 2636 wrote to memory of 2604	2636	cmd.exe	32
PID 2636 wrote to memory of 2604	2636	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\1e003954447b1fd20f1c8b70843bbf89.exe
"C:\Users\Admin\AppData\Local\Temp\1e003954447b1fd20f1c8b70843bbf89.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" "javascript:new ActiveXObject('WScript.Shell').Run('SOLA_2.0_289921666618591.bat',0);window.close()"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\SOLA_2.0_289921666618591.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c date /t
      4⤵
      PID:2584
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c dir C:\Windows\explorer.exe
      4⤵
      PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SOLA_2.0_289921666618591.bat

Filesize
10KB

MD5
39480d4fcb3e0ec50dcd49b8ba993e1e

SHA1
9b1cc3ba81a705dfd707860e9631e131ce4d7cd0

SHA256
62e390d429f1db85cc0d55944ce2d379a71d5e7e3be0899cc0fc5faad3face21

SHA512
72e07ab09d0508181530a26c4a849dc6337c16ecf9258ba9a0fd091842a36c55babb1e58cbaf296b1370b3cc549fbc338fe7079f462679322346d6e884d720a0

Download Submit
memory/3044-6-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download