a16abe881174be1dda03fbb5ecb793571ead0435e26145d61c43127e08325660

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1651795679aafd48a42c509b5085ee54.exe
Size

132KB
MD5

1651795679aafd48a42c509b5085ee54
SHA1

5f9863876a67af2b1c665f699d1f9a007be19869
SHA256

a16abe881174be1dda03fbb5ecb793571ead0435e26145d61c43127e08325660
SHA512

3cd80519296517506269c3ef0378b4d47ad5ff98e2467ecb8bbe1807dd82581839490b1b47596c1be89b9ba1f23aa6410ed5a0bf30cf6190b49d6fa00e47119a
SSDEEP

3072:ZeBJrwCC2GlRMWiQF1H6ph0X1LE8/5Wu8OkljAoxLss0k:ZAJ832HQz6peX1//sHnxLssZ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2660	2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\2.exe	1651795679aafd48a42c509b5085ee54.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2180	1651795679aafd48a42c509b5085ee54.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2660	2180	1651795679aafd48a42c509b5085ee54.exe	14
PID 2180 wrote to memory of 2660	2180	1651795679aafd48a42c509b5085ee54.exe	14
PID 2180 wrote to memory of 2660	2180	1651795679aafd48a42c509b5085ee54.exe	14
PID 2180 wrote to memory of 2660	2180	1651795679aafd48a42c509b5085ee54.exe	14

C:\Windows\2.exe
"C:\Windows\2.exe"
1⤵
- Executes dropped EXE
PID:2660

C:\Users\Admin\AppData\Local\Temp\1651795679aafd48a42c509b5085ee54.exe
"C:\Users\Admin\AppData\Local\Temp\1651795679aafd48a42c509b5085ee54.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-8-0x00000000028F0000-0x000000000293A000-memory.dmp

Filesize
296KB

Download
memory/2180-9-0x00000000028F0000-0x000000000293A000-memory.dmp

Filesize
296KB

Download
memory/2180-1-0x0000000000400000-0x0000000000424200-memory.dmp

Filesize
144KB

Download
memory/2660-10-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download