d3afd9960023def9b6e8caf5edc05c6f70ed8f513d0cb7c28cee042de04087f3

Analysis

max time kernel
179s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22c641737d8143bb91bbbd0150c2337c.exe
Size

545KB
MD5

22c641737d8143bb91bbbd0150c2337c
SHA1

ae4d03cae5bb648cbf134c4937eefe20bb9c8dc0
SHA256

d3afd9960023def9b6e8caf5edc05c6f70ed8f513d0cb7c28cee042de04087f3
SHA512

a5fdcad11745aa30d9ff786bef63bc143de744dcb690ef8a36371596c4c54ecc5a536f973c9c3fcf2f2083a4766ccb1b2a1eb10ddf67a4348e23266415da62a6
SSDEEP

12288:76PiijUbYmAjQnbamML4l/GoZMn/aaQMX0k:2KtAybaH4ptMn/aaXEk

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\newiexplore.exe	22c641737d8143bb91bbbd0150c2337c.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\newiexplore.exe	22c641737d8143bb91bbbd0150c2337c.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\taobao.ico	22c641737d8143bb91bbbd0150c2337c.exe
File created	C:\Windows\sppert.ini	22c641737d8143bb91bbbd0150c2337c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\22c641737d8143bb91bbbd0150c2337c.exe
"C:\Users\Admin\AppData\Local\Temp\22c641737d8143bb91bbbd0150c2337c.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2304-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2304-12-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2304-13-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2304-14-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download