4a02dac9d9962ef6827c5d964e5cc3f125def1398400a41ca2a4de42fa257a0c

Analysis

max time kernel
1s
max time network
19s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a62fd10b045ec7060e0459a38b6771e.exe
Size

17KB
MD5

0a62fd10b045ec7060e0459a38b6771e
SHA1

1fcfa6f4a158c20ecefb7f1755fc7dfcfab07b5a
SHA256

4a02dac9d9962ef6827c5d964e5cc3f125def1398400a41ca2a4de42fa257a0c
SHA512

c72d8b093dd739340321bd8eacdcb34f73471f656f0a5cfd21c6c84643aea42b70bcb1873cb6b0005f53ec29ff97f564044162c77ddaeb0a0d03ca4e6af9bd38
SSDEEP

384:y6ZIc+fZRgdjFNnI2G3FIcZLQRmgOriC5m+/C:ysIzLgJHI269vguicm+6

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2180	0a62fd10b045ec7060e0459a38b6771e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\WINSvr32 = "C:\\Windows\\WINSvr32.exE"	0a62fd10b045ec7060e0459a38b6771e.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WINSvr32.dll	0a62fd10b045ec7060e0459a38b6771e.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\WINSvr32.exE	0a62fd10b045ec7060e0459a38b6771e.exe
File opened for modification	C:\Windows\WINSvr32.exE	0a62fd10b045ec7060e0459a38b6771e.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2180	0a62fd10b045ec7060e0459a38b6771e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2180	0a62fd10b045ec7060e0459a38b6771e.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1272	2180	0a62fd10b045ec7060e0459a38b6771e.exe	18
PID 2180 wrote to memory of 1272	2180	0a62fd10b045ec7060e0459a38b6771e.exe	18

C:\Users\Admin\AppData\Local\Temp\0a62fd10b045ec7060e0459a38b6771e.exe
"C:\Users\Admin\AppData\Local\Temp\0a62fd10b045ec7060e0459a38b6771e.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\WINSvr32.dll

Filesize
27KB

MD5
76aff1c17b1d22b61cf95998c10fd6fa

SHA1
ceeccc5a1cbfd298d31ca6e8803003ba0f23b068

SHA256
a47efe61984359ab801ef17401748b776e7de10d4f7cfc83ebdc31de727acf08

SHA512
bd3eab49617a125ef4304c441f1482daa09627bfa43da950241c7f012ee055e2e241ffe459a13c5418d93bfa9f0696e9805dcb78e7d2f79250846713708d4213

Download Submit
memory/1272-2-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/2180-8-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2180-12-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download