9be24b5620f91a390cec4c24d6b418366c6cb917f81d4fcb39ac1b7dafe7f5b3

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0c017d2c8dfd86a9534fa7314d2f1f46.exe
Size

294KB
MD5

0c017d2c8dfd86a9534fa7314d2f1f46
SHA1

2c3acea2d0b5b953f58696a776e8bbd11dfcb7f6
SHA256

9be24b5620f91a390cec4c24d6b418366c6cb917f81d4fcb39ac1b7dafe7f5b3
SHA512

3f0c2a9f6cd7ad4eb5c821d297d46946394bb2f900478b56da4214515c24cc37b05cd6e3f859187cebb5146068f52b64b29d4961e2f52ea2180e22670e32b7e7
SSDEEP

6144:Mlxlt7b8pljdSaqYBZamRM8wGoGQW8ErbSDO1Wz/Y/NYVu:2x37b8pGarBl9wtGQYvST8/V

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2472	3.exe

Loads dropped DLL 1 IoCs

pid	Process
2156	0c017d2c8dfd86a9534fa7314d2f1f46.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2472	3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2472	2156	0c017d2c8dfd86a9534fa7314d2f1f46.exe	28
PID 2156 wrote to memory of 2472	2156	0c017d2c8dfd86a9534fa7314d2f1f46.exe	28
PID 2156 wrote to memory of 2472	2156	0c017d2c8dfd86a9534fa7314d2f1f46.exe	28
PID 2156 wrote to memory of 2472	2156	0c017d2c8dfd86a9534fa7314d2f1f46.exe	28

C:\Users\Admin\AppData\Local\Temp\0c017d2c8dfd86a9534fa7314d2f1f46.exe
"C:\Users\Admin\AppData\Local\Temp\0c017d2c8dfd86a9534fa7314d2f1f46.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\3.exe
  "C:\Users\Admin\AppData\Local\Temp\3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3.exe

Filesize
126KB

MD5
9d9315a62f2aaaea200614bb88752983

SHA1
d3c8da2602442a8c779434232ad74ecc19314e91

SHA256
a2cb8dec3b29ac58af56952f1a487bcda5135b5e6e5494f27d703142e41356d9

SHA512
593bbc5712a9ca721de7fec20447fd3f81bda6685d34e8ac43f8dd294ac8802aca3fa8cfed1472a10a617c6b81410361dfaa014348caedc250def3b2311c8431

Download Submit
memory/2156-0-0x0000000000DF0000-0x0000000000E18000-memory.dmp

Filesize
160KB

Download
memory/2156-1-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/2156-2-0x0000000004940000-0x0000000004980000-memory.dmp

Filesize
256KB

Download
memory/2156-13-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/2472-14-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/2472-12-0x00000000049C0000-0x0000000004A00000-memory.dmp

Filesize
256KB

Download
memory/2472-11-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/2472-10-0x00000000008C0000-0x00000000008E8000-memory.dmp

Filesize
160KB

Download