877822bf052ce6e25bc2c5b535bb9571f46ff6ed6040d30f6169054133799cba

Analysis

max time kernel
2s
max time network
19s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b9166401303584d7d0000c9633343c7.exe
Size

108KB
MD5

2b9166401303584d7d0000c9633343c7
SHA1

b16e55c8825612453a2bc106abbc83f18da129a8
SHA256

877822bf052ce6e25bc2c5b535bb9571f46ff6ed6040d30f6169054133799cba
SHA512

7252448066015ea687dbd8a0f07410bdd1432114011b0d16169f18f07d8b72a8f6292b36ce6169b55b4d5c8ddd83532c2fde26a7a2c1d2c90c85be5652ffaca4
SSDEEP

1536:t055xWzJVa2iXr3V55w6yci8lsS8e9Ypwuu:t05zGg2Exw6Bi8n5

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2212	2b9166401303584d7d0000c9633343c7.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\MsIMMs32 = "C:\\Windows\\MsIMMs32.exE"	2b9166401303584d7d0000c9633343c7.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MsIMMs32.dll	2b9166401303584d7d0000c9633343c7.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\MsIMMs32.exE	2b9166401303584d7d0000c9633343c7.exe
File opened for modification	C:\Windows\MsIMMs32.exE	2b9166401303584d7d0000c9633343c7.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2212	2b9166401303584d7d0000c9633343c7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2212	2b9166401303584d7d0000c9633343c7.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 1244	2212	2b9166401303584d7d0000c9633343c7.exe	10
PID 2212 wrote to memory of 1244	2212	2b9166401303584d7d0000c9633343c7.exe	10

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1244
- C:\Users\Admin\AppData\Local\Temp\2b9166401303584d7d0000c9633343c7.exe
  "C:\Users\Admin\AppData\Local\Temp\2b9166401303584d7d0000c9633343c7.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\MsIMMs32.dll

Filesize
34KB

MD5
8fa1d2e6d326b5c326c683aad3c22bd5

SHA1
34db077785ef84d511751b4fbfff7371efeb448d

SHA256
dc32233a2c42cf0619ff27e47e9e829d4516fef4886cf6450b2abcd0f5206f8d

SHA512
dfe47a851df2e25feeda1d9d3a3fcd790853cd4f12dfebc59fe92bf7f0eef6575500d1678ad3fecc5c0b5fd30a827a5ba724ca4f13692d05be56f91098f9de9e

Download Submit
memory/1244-3-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/2212-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2212-9-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2212-12-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download