1ac8fb7ab9abe5cdbf56cf791f3e35eb4c08d810a236e3399679ef0f82d3861d

Analysis

max time kernel
142s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

photo2scr.exe
Size

1.5MB
MD5

3dd264e94f98b5628efe2e7fec99b5fa
SHA1

1e3f5f152da577b0d67fd4f97017e031dde54426
SHA256

ef7a5cf8e4c927ea847e966943dd9da773b6698e60c1578913650ae28fac32df
SHA512

fec20f9c6d4c0eaccef7e4881d21b968fc080eac2593c92e351408a5f9c1e6d40b1002b3780b8db2f55045e2e8eb9331fb199597de830e84f92be05412e3f434
SSDEEP

24576:gpniOA5rBBMPyZ1ZRZBrbn9p6FbMA/i5/AyGyB4v9VfFZjECNpSB2+GIxnsvsdyl:eiOAnBW+XxrBpmK5jGm41jZugBkyl

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2064	is-UDKNK.tmp

Loads dropped DLL 3 IoCs

pid	Process
2296	photo2scr.exe
2064	is-UDKNK.tmp
2064	is-UDKNK.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2064	is-UDKNK.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2064	2296	photo2scr.exe	28
PID 2296 wrote to memory of 2064	2296	photo2scr.exe	28
PID 2296 wrote to memory of 2064	2296	photo2scr.exe	28
PID 2296 wrote to memory of 2064	2296	photo2scr.exe	28
PID 2296 wrote to memory of 2064	2296	photo2scr.exe	28
PID 2296 wrote to memory of 2064	2296	photo2scr.exe	28
PID 2296 wrote to memory of 2064	2296	photo2scr.exe	28

C:\Users\Admin\AppData\Local\Temp\photo2scr.exe
"C:\Users\Admin\AppData\Local\Temp\photo2scr.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\is-DVAQU.tmp\is-UDKNK.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DVAQU.tmp\is-UDKNK.tmp" /SL4 $30150 "C:\Users\Admin\AppData\Local\Temp\photo2scr.exe" 1352839 52224
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-DVAQU.tmp\is-UDKNK.tmp

Filesize
92KB

MD5
0186461547d0bba32e1fe0b8b33f0895

SHA1
8fafd9dfff35b3b31a64b79729ed92d0a01044f3

SHA256
c470f414af61f873405e96fa11e602cf31c3f45dfc7858fd0b1fb83cb2ca5348

SHA512
7c11f6651ad15747577e13763690d6c06d9104e83929bc2a4ae454e8fbbd9226ff5ac296946929c16aeec27d12b779f7f35eac7930f45c5e6c1b1216b70b6787

Download Submit
\Users\Admin\AppData\Local\Temp\is-DVAQU.tmp\is-UDKNK.tmp

Filesize
642KB

MD5
3c9f925549a51f9017e08a072332fa47

SHA1
1bff860e744467a58ef986b1016a4454844f5ad7

SHA256
1eb6ba689a47d91d01c9b3caa93daacec49c7b6daafb217678b9ad8f545c8ac2

SHA512
86112ec0d9f4254bceb0a576bc03e09384a15a4a5e94b08ca65ddfbc60d9d8d459885138c2644c9309ac86bca0b86d41c92dbc8ed23d7d381cdbeb2d7963ec18

Download Submit
memory/2064-15-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2296-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2296-14-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download