f4ca8e55e27b91566b47a9ed4597cae418805bcf444e15a692158f362a2ba51f

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2471adff580f3b41360dfd98c2e97079.exe
Size

48KB
MD5

2471adff580f3b41360dfd98c2e97079
SHA1

64d3cf11b837be6d7a1f27ae5210978c5062f00e
SHA256

f4ca8e55e27b91566b47a9ed4597cae418805bcf444e15a692158f362a2ba51f
SHA512

405fcd97e1b768f8e2a66c523fb16d426d15b4993e2d15b410a7ca7a32f214c27ef02e49df7577807376b6c1556b4bd2ab86f257add7a679df54dd7d8b4399f9
SSDEEP

768:SbAO5Dt87tXIPmggNstFpQqXxGVbRQ1nTKE7GrC:SX5x8dIPzgNstbQqXEc1tCrC

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2220	MSN.exe

Loads dropped DLL 2 IoCs

pid	Process
2620	2471adff580f3b41360dfd98c2e97079.exe
2620	2471adff580f3b41360dfd98c2e97079.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2620	2471adff580f3b41360dfd98c2e97079.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2220	2620	2471adff580f3b41360dfd98c2e97079.exe	28
PID 2620 wrote to memory of 2220	2620	2471adff580f3b41360dfd98c2e97079.exe	28
PID 2620 wrote to memory of 2220	2620	2471adff580f3b41360dfd98c2e97079.exe	28
PID 2620 wrote to memory of 2220	2620	2471adff580f3b41360dfd98c2e97079.exe	28

C:\Users\Admin\AppData\Local\Temp\2471adff580f3b41360dfd98c2e97079.exe
"C:\Users\Admin\AppData\Local\Temp\2471adff580f3b41360dfd98c2e97079.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Users\Admin\AppData\Local\Temp\MSN.exe
  "C:\Users\Admin\AppData\Local\Temp\MSN.exe"
  2⤵
  - Executes dropped EXE
  PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\MSN.exe

Filesize
28KB

MD5
e1b7275e4835b64893b03e08ba4e3467

SHA1
215b3849ef414d4424c3a11f5787c0227e4502e4

SHA256
96a0816b3872ead4f5636fdfea5e32f8e445cd98999f24ee8676dc789dcf641e

SHA512
d6d6ede4694d6390464f0c4f60791c5172d3abf89e7ef7610c86ab3ded25637410a45d1cfa4459c68fdc34330ad1279ac6ee889f8a2d79a591d10f701304147e

Download Submit