Overview

overview

10

Static

static

3

0155e35d6b...22.exe

windows7-x64

10

0155e35d6b...22.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    01/01/2024, 09:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0155e35d6bf8759c362f66abab374022.exe

  • Size

    68KB

  • MD5

    0155e35d6bf8759c362f66abab374022

  • SHA1

    89e4460560ea164e62a6432fd8100c34406ac237

  • SHA256

    b54451a17490f0837b2a77491fb0e7c38e8ec2389fc3de700f218d941d255882

  • SHA512

    363651c7303013f1e6432cfb6f91f9857c4b2f81e79479127ce16143a869ef05bf7c963031c74165c1778fffc90b6672e6eb0f3b294dc23ec0084f15935c0168

  • SSDEEP

    768:FcVliTdyOAl+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:iVIx1AcqOK3qowgnt1d

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0155e35d6bf8759c362f66abab374022.exe
    "C:\Users\Admin\AppData\Local\Temp\0155e35d6bf8759c362f66abab374022.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2816
    • C:\Users\Admin\Admin.exe
      "C:\Users\Admin\Admin.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2336

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Admin.exe
    Filesize

    68KB

    MD5

    1032e7ae829871c9d5911d18c3b51731

    SHA1

    136d9e0649ee98fa6fb52199f015bdc0ca77fc71

    SHA256

    736d9422b5eeedfdb4f308509e7ae5e2c3f04494bba51b51dc4e935d30752222

    SHA512

    b8120b63c255cdd4f38ec876bdc0067de638913b680180f11261abdab487cb23498c9ba1eef44b3ce44f9342d5511b4ef8f0d282c7a0da2b9a6d3d7caf3dcae1

    Download Submit

  • \Users\Admin\Admin.exe
    Filesize

    44KB

    MD5

    b154d2d1abe1a9bc1bde9563e239e81a

    SHA1

    13c1f928ad0be577149537ab7cc8a361466c97b3

    SHA256

    0ee8698d675f1f703afc2e2f7a96206ff67b8ccc5b08bcd6c086df92072db46d

    SHA512

    df132f7d59d8515300eb189d3c73754fc8b1051f769d9e8c75e9195e6d3d5bf56a7bc021ab3af51557d5acfca5e971ce8076747b8d0fa07a54ce1b150f264e0c

    Download Submit

  • memory/2336-13-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

    Download

  • memory/2816-0-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

    Download