b2fff1529b1232e5afe344dddafab69552dfe9653f5da8f85ee7453055294f2c

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

257aecb9a7fb81b0ee497791ddbcfad7.exe
Size

129KB
MD5

257aecb9a7fb81b0ee497791ddbcfad7
SHA1

36862a3abf1627130b2f74b2b975636759221b8d
SHA256

b2fff1529b1232e5afe344dddafab69552dfe9653f5da8f85ee7453055294f2c
SHA512

7de2e72047daa52d2e973363d9ae8c52d5c56230bdae472de5b8ee843908d3699e9026ec3e29cf50001ec294a4c18c43170c74518808f26857069f8b9116de8c
SSDEEP

3072:UYjfcRDQ7Wu4ZSXNgKpxeJQ755ToUXLAKwAXdj:mRZu40XNZd5JfJ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2196	2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\2.exe	257aecb9a7fb81b0ee497791ddbcfad7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1528	2196	WerFault.exe	28

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2932	257aecb9a7fb81b0ee497791ddbcfad7.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2196	2932	257aecb9a7fb81b0ee497791ddbcfad7.exe	28
PID 2932 wrote to memory of 2196	2932	257aecb9a7fb81b0ee497791ddbcfad7.exe	28
PID 2932 wrote to memory of 2196	2932	257aecb9a7fb81b0ee497791ddbcfad7.exe	28
PID 2932 wrote to memory of 2196	2932	257aecb9a7fb81b0ee497791ddbcfad7.exe	28
PID 2196 wrote to memory of 1528	2196	2.exe	29
PID 2196 wrote to memory of 1528	2196	2.exe	29
PID 2196 wrote to memory of 1528	2196	2.exe	29
PID 2196 wrote to memory of 1528	2196	2.exe	29

C:\Users\Admin\AppData\Local\Temp\257aecb9a7fb81b0ee497791ddbcfad7.exe
"C:\Users\Admin\AppData\Local\Temp\257aecb9a7fb81b0ee497791ddbcfad7.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\2.exe
  "C:\Windows\2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 36
    3⤵
    - Program crash
    PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\2.exe

Filesize
116KB

MD5
9e10659c7f01c216b01ec5213c5ee374

SHA1
8359dc03ffeabecab4d14f33aca67f43d9e3e9d4

SHA256
a8fbe0121e7631176705c4a9e2a941a5b6bf199db5922ab9d79cab75e8cd5869

SHA512
1d7c1e8656800fc7dd5f7aac66002d48f9869c89d80c75cbf856a4b5e995ca4990d4e115f39f33f2abe1f89ab74271ee1697abe374f3e6eb1b0959b6cbe1a8cc

Download Submit
memory/2196-9-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2932-0-0x0000000000400000-0x0000000000422200-memory.dmp

Filesize
136KB

Download
memory/2932-4-0x00000000027C0000-0x000000000280E000-memory.dmp

Filesize
312KB

Download