b9d751235267bec2ee54486e726a847ae3521f4111b9f0ebac9d1e5231e00205

Analysis

max time kernel
128s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 09:34

Target

149e726e62cfbbdfb8c0a71b831993fb.exe
Size

11KB
MD5

149e726e62cfbbdfb8c0a71b831993fb
SHA1

2064d3d5f21e03a1ee2175e2474f6a721f843b39
SHA256

b9d751235267bec2ee54486e726a847ae3521f4111b9f0ebac9d1e5231e00205
SHA512

3bec0c4ebcf585681f6172fe6b55a9fdde12860062f5b570ef09483b60ea1edf8fdbfa71e4250eae87057394664e14a26f6fa5247fc110861b7f62a826a03b2e
SSDEEP

192:knIwaOifG69CFFCo/1pMuLdu9w/qnB3xh4oQAwOB+m0i:kS9u6AzCo/1LLwGqxso2OBx

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2536	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2032-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2032-1-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl\CLSID	149e726e62cfbbdfb8c0a71b831993fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl	149e726e62cfbbdfb8c0a71b831993fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl\CLSID\ = "{6BF52A52-394A-11D3-B153-00C04F79FAA6}"	149e726e62cfbbdfb8c0a71b831993fb.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2032	149e726e62cfbbdfb8c0a71b831993fb.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2508	2032	149e726e62cfbbdfb8c0a71b831993fb.exe	28
PID 2032 wrote to memory of 2508	2032	149e726e62cfbbdfb8c0a71b831993fb.exe	28
PID 2032 wrote to memory of 2508	2032	149e726e62cfbbdfb8c0a71b831993fb.exe	28
PID 2032 wrote to memory of 2508	2032	149e726e62cfbbdfb8c0a71b831993fb.exe	28
PID 2032 wrote to memory of 2536	2032	149e726e62cfbbdfb8c0a71b831993fb.exe	32
PID 2032 wrote to memory of 2536	2032	149e726e62cfbbdfb8c0a71b831993fb.exe	32
PID 2032 wrote to memory of 2536	2032	149e726e62cfbbdfb8c0a71b831993fb.exe	32
PID 2032 wrote to memory of 2536	2032	149e726e62cfbbdfb8c0a71b831993fb.exe	32

C:\Users\Admin\AppData\Local\Temp\149e726e62cfbbdfb8c0a71b831993fb.exe
"C:\Users\Admin\AppData\Local\Temp\149e726e62cfbbdfb8c0a71b831993fb.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\ctfmon.exe
  ctfmon.exe
  2⤵
  PID:2508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\wewt0.bat" "
  2⤵
  - Deletes itself
  PID:2536

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\wewt0.bat

Filesize
274B

MD5
ce07d53a29198f39a1a49ac28e92670c

SHA1
abf51d773b38a7ea9bb58ee272370db2311671f6

SHA256
8f761052ffe47e267c4f038fa602c9eff022a9f0e06257e3fd51323f6723f11d

SHA512
ba48b1c453575f52feb57da3dca0a3fda24026b494d94353ff4477558ab0b8e6d109f57d0883522a85a21a5bb2fb4911fc05170bf986174c8280376602f77719

Download Submit
memory/2032-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2032-1-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download