16c6633a92fd54c7817e68b7d4aa4dfddd3f0527312b5e7da0f0f1616cbd9c01

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1ca2c3c36e08a6243adca0ce6b615b35.exe
Size

180KB
MD5

1ca2c3c36e08a6243adca0ce6b615b35
SHA1

9d17ccf2cf11333bca803c765c243602a80076f8
SHA256

16c6633a92fd54c7817e68b7d4aa4dfddd3f0527312b5e7da0f0f1616cbd9c01
SHA512

6b25ad30fe3ba3f10272188d27c9b5498433eedec9eb7910e39ef35e5829bbce1b7451c353f41c5a89ab221e4ce75ce5f9fef817ab1cc4d08c64e42cbcc1e66d
SSDEEP

3072:pwxVMhOC/dTmbq91+mno3t4QZQ3rh2TTNTJTCN5gTGhSkT5dgsUGOgkBFVYbsVTM:pTfFmbRnOTr085p8mkJ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL\OPENHOMEPAGE\COMMAND	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL\OPENHOMEPAGE	WScript.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2744	WScript.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2744	WScript.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2744	1308	1ca2c3c36e08a6243adca0ce6b615b35.exe	28
PID 1308 wrote to memory of 2744	1308	1ca2c3c36e08a6243adca0ce6b615b35.exe	28
PID 1308 wrote to memory of 2744	1308	1ca2c3c36e08a6243adca0ce6b615b35.exe	28
PID 1308 wrote to memory of 2744	1308	1ca2c3c36e08a6243adca0ce6b615b35.exe	28

C:\Users\Admin\AppData\Local\Temp\1ca2c3c36e08a6243adca0ce6b615b35.exe
"C:\Users\Admin\AppData\Local\Temp\1ca2c3c36e08a6243adca0ce6b615b35.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.vbs"
  2⤵
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.vbs

Filesize
4KB

MD5
e03a6d8706439219a332d8fc5c626fa0

SHA1
f76fd1455e8b8f1374868bb34e39ca02535a4914

SHA256
749e687a8aa4ea6d6bca03f26527029e0cc7c80b476b11c00f0c9bff4bb7c656

SHA512
ba96a82ba02e8392e8b32e565dcbe0149db9de7623a795c9cc4bfe9897397b1fb37f24b8c8eca9c2b9438de30d537cde73ef3524c39e29ab4f4495b38077a6c6

Download Submit
memory/1308-11-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1308-12-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download