78b501509d17af404f51089714d6b064d2e0cee0b2904a190ce3a6db359aceab

Analysis

max time kernel
82s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

234bf13ed07d0a10a651a1c37c0a367f.exe
Size

430KB
MD5

234bf13ed07d0a10a651a1c37c0a367f
SHA1

350a64e34ece1da83a360bf3f0d91497478c0d97
SHA256

78b501509d17af404f51089714d6b064d2e0cee0b2904a190ce3a6db359aceab
SHA512

5009fbd2d4e17eb276ea5c35d6793d9e5b603e4cbecd48c83947c95e3a53289d26aab0b4e6647be9e4b145baf4e75ce6aa6af5773bce731a767e3edb1df8f591
SSDEEP

12288:ibee0PGl89WazvzkmMxM+ltxQMAn0Iv1b70ZSf2/:2edGBazvZMHltxtIv1bUS+/

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Winder.lnk	234bf13ed07d0a10a651a1c37c0a367f.exe

Loads dropped DLL 1 IoCs

pid	Process
2664	234bf13ed07d0a10a651a1c37c0a367f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\234bf13ed07d0a10a651a1c37c0a367f.exe = "C:\\System32\\234bf13ed07d0a10a651a1c37c0a367f.exe"	234bf13ed07d0a10a651a1c37c0a367f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2664	234bf13ed07d0a10a651a1c37c0a367f.exe
2664	234bf13ed07d0a10a651a1c37c0a367f.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2664	234bf13ed07d0a10a651a1c37c0a367f.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2664	234bf13ed07d0a10a651a1c37c0a367f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2664	234bf13ed07d0a10a651a1c37c0a367f.exe
2664	234bf13ed07d0a10a651a1c37c0a367f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2428	2664	234bf13ed07d0a10a651a1c37c0a367f.exe	28
PID 2664 wrote to memory of 2428	2664	234bf13ed07d0a10a651a1c37c0a367f.exe	28
PID 2664 wrote to memory of 2428	2664	234bf13ed07d0a10a651a1c37c0a367f.exe	28
PID 2664 wrote to memory of 2428	2664	234bf13ed07d0a10a651a1c37c0a367f.exe	28

C:\Users\Admin\AppData\Local\Temp\234bf13ed07d0a10a651a1c37c0a367f.exe
"C:\Users\Admin\AppData\Local\Temp\234bf13ed07d0a10a651a1c37c0a367f.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS1.vbs"
  2⤵
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS1.vbs

Filesize
653B

MD5
211ef5781c0d609c45734d8eade3947d

SHA1
e838b5b9814996045fb5d7b664d33165f11c9fb6

SHA256
4cbef597444779522cb417b3897213df4fc1a44e6a3343d135e1c74fcc5738e1

SHA512
a6ef9f3f67116797e78829bc1c0cbf471628d8b6cb8cb114040f56590794857ec4b1bbd079324f2b01e735250546341f9ab939909c2a20eac03589da4fc12228

Download Submit
\System32\234bf13ed07d0a10a651a1c37c0a367f.exe

Filesize
430KB

MD5
57facd88173d1948262390e75aa6655e

SHA1
6762032447f76bf1e33c96af4ee0803415c87069

SHA256
06a2b7e48f2f9d59dc9836b14cd5853607869c6044b4ec56699b006bc1ae6b36

SHA512
673cc0d5bd6ac808c2859c73ef22e4a3871c23392e61c17abfd71220eebcbed4136a4a957ecc98efe49c4b237628a281710585699d23bf2b5bcd6ff6321df4b1

Download Submit
memory/2664-0-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2664-7-0x0000000000630000-0x0000000000640000-memory.dmp

Filesize
64KB

Download
memory/2664-13-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2664-14-0x0000000000630000-0x0000000000640000-memory.dmp

Filesize
64KB

Download