fb25db075a57a1a9c51115eaad1a8dc42f7f7344d8aedf1b864887b521b440c4

Analysis

max time kernel
150s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f00a9c4b14481bd86f8022e63eda48f.exe
Size

197KB
MD5

3f00a9c4b14481bd86f8022e63eda48f
SHA1

3b61e596441bcbeb8176413e68a04f49a87b3366
SHA256

fb25db075a57a1a9c51115eaad1a8dc42f7f7344d8aedf1b864887b521b440c4
SHA512

f58fe438635e4ed27a7e7e595f0cf68c6454300f2df41875177607e3dd3652af4985b86cdcc8459e7c1535ae61aa2051bcaebf22cedb76454dd66cb79a7a42e2
SSDEEP

3072:O2VzMvCZU0OGReIhOJoA72uIiSjy3gm9FaXAnU3PXAvAm6mlzbl7735lNxlmSbR8:PrZUkReIh/o3zn1UfXAYhU3lXJ7xlm

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2388	Hsitaa.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\TG0PTF86JH = "C:\\Windows\\Hsitaa.exe"	Hsitaa.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job	3f00a9c4b14481bd86f8022e63eda48f.exe
File opened for modification	C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job	3f00a9c4b14481bd86f8022e63eda48f.exe
File created	C:\Windows\Hsitaa.exe	3f00a9c4b14481bd86f8022e63eda48f.exe
File opened for modification	C:\Windows\Hsitaa.exe	3f00a9c4b14481bd86f8022e63eda48f.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe
2388	Hsitaa.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 2388	1216	3f00a9c4b14481bd86f8022e63eda48f.exe	28
PID 1216 wrote to memory of 2388	1216	3f00a9c4b14481bd86f8022e63eda48f.exe	28
PID 1216 wrote to memory of 2388	1216	3f00a9c4b14481bd86f8022e63eda48f.exe	28
PID 1216 wrote to memory of 2388	1216	3f00a9c4b14481bd86f8022e63eda48f.exe	28

C:\Users\Admin\AppData\Local\Temp\3f00a9c4b14481bd86f8022e63eda48f.exe
"C:\Users\Admin\AppData\Local\Temp\3f00a9c4b14481bd86f8022e63eda48f.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\Hsitaa.exe
  C:\Windows\Hsitaa.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Hsitaa.exe

Filesize
197KB

MD5
3f00a9c4b14481bd86f8022e63eda48f

SHA1
3b61e596441bcbeb8176413e68a04f49a87b3366

SHA256
fb25db075a57a1a9c51115eaad1a8dc42f7f7344d8aedf1b864887b521b440c4

SHA512
f58fe438635e4ed27a7e7e595f0cf68c6454300f2df41875177607e3dd3652af4985b86cdcc8459e7c1535ae61aa2051bcaebf22cedb76454dd66cb79a7a42e2

Download Submit
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

Filesize
344B

MD5
68d6055659b7e2ce72ed2101447aeb57

SHA1
dbbac5eb00c02b1c9aeb2c141612c23e0137ee54

SHA256
dd05f07c7b8762fbe404c54cac27164ab4b61e8c3c32c1ae8d77003273ae4ccb

SHA512
45755481fb9fd246fa20acd9c0a44ba974261c91e0c58277e250fd10f820f7c35f30087194a6d797923348a57096cbdfaa38c5f0893b9c0c926f5b0f3ae3e679

Download Submit
memory/1216-0-0x0000000000220000-0x000000000027E000-memory.dmp

Filesize
376KB

Download
memory/1216-1-0x0000000000220000-0x000000000027E000-memory.dmp

Filesize
376KB

Download
memory/1216-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1216-9825-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1216-34405-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2388-13-0x0000000000300000-0x000000000035E000-memory.dmp

Filesize
376KB

Download
memory/2388-27001-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2388-43890-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2388-43891-0x0000000000300000-0x000000000035E000-memory.dmp

Filesize
376KB

Download