536817c2d7191ccb443ab5039bd4fd3cba41763c66590c4a1647a61a28239ddb

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39e6662d7d3614fb757ac6141e887f67.exe
Size

2KB
MD5

39e6662d7d3614fb757ac6141e887f67
SHA1

28236bc8b812b0b092cb6b5db943a696f5d6107f
SHA256

536817c2d7191ccb443ab5039bd4fd3cba41763c66590c4a1647a61a28239ddb
SHA512

1a71bd505826451d07c3c9f24dfcd6480e4f366915dc40bacb86ab67b4c1e25dfe5afde298a0838ac130edbcc861cb8aca8cc2759dc050b88d13ec8ba85693d0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3044	39e6662d7d3614fb757ac6141e887f67.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2976	3044	39e6662d7d3614fb757ac6141e887f67.exe	28
PID 3044 wrote to memory of 2976	3044	39e6662d7d3614fb757ac6141e887f67.exe	28
PID 3044 wrote to memory of 2976	3044	39e6662d7d3614fb757ac6141e887f67.exe	28
PID 3044 wrote to memory of 2976	3044	39e6662d7d3614fb757ac6141e887f67.exe	28
PID 2976 wrote to memory of 2712	2976	cmd.exe	30
PID 2976 wrote to memory of 2712	2976	cmd.exe	30
PID 2976 wrote to memory of 2712	2976	cmd.exe	30
PID 2976 wrote to memory of 2712	2976	cmd.exe	30
PID 2712 wrote to memory of 2788	2712	net.exe	31
PID 2712 wrote to memory of 2788	2712	net.exe	31
PID 2712 wrote to memory of 2788	2712	net.exe	31
PID 2712 wrote to memory of 2788	2712	net.exe	31

C:\Users\Admin\AppData\Local\Temp\39e6662d7d3614fb757ac6141e887f67.exe
"C:\Users\Admin\AppData\Local\Temp\39e6662d7d3614fb757ac6141e887f67.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net stop sharedaccess
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download