748f94cd164b60cec19d6353d609252813cfb378e72727573b4cfe29403c8ffd

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe
Size

9.8MB
MD5

77798895d180e0b70a650e81ebe911e4
SHA1

06e1073549feaf566b999a7be57ea00d130ae1d7
SHA256

981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe
SHA512

c8cf10d84dbfd4976e4446c53e31ddf8b89de24e683036c42a095060b05cc3ed2efca9cc25e32e7ca5735b61b34b5a16f131a4fcb4256e667cf9fc59182fdf43
SSDEEP

196608:9XI+y0cv7pNJiNzV9EeXz0a2AH/wk57sYD6AGigYEbwfrbr4JFSaDMigmv4fl+ji:rcv7pNJimeXF2Rk5/hehbwfrFWMTmElH

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\controle_comercial.log	981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe
File opened for modification	C:\Windows\controle_comercial.log	981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1556	981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe
1556	981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe
1556	981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe
1556	981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 2364	1556	981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe	28
PID 1556 wrote to memory of 2364	1556	981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe	28
PID 1556 wrote to memory of 2364	1556	981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe	28
PID 1556 wrote to memory of 2364	1556	981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe	28

C:\Users\Admin\AppData\Local\Temp\981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe
"C:\Users\Admin\AppData\Local\Temp\981d78dc925222eabf5bf2b268c2aabba8b9d25ad62b4406afb1198847cd4ebe.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1556-0-0x0000000000400000-0x00000000026E9000-memory.dmp

Filesize
34.9MB

Download
memory/1556-1-0x0000000000400000-0x00000000026E9000-memory.dmp

Filesize
34.9MB

Download
memory/1556-7-0x0000000000400000-0x00000000026E9000-memory.dmp

Filesize
34.9MB

Download
memory/1556-8-0x0000000000400000-0x00000000026E9000-memory.dmp

Filesize
34.9MB

Download
memory/1556-9-0x0000000000400000-0x00000000026E9000-memory.dmp

Filesize
34.9MB

Download
memory/1556-10-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download