31fbbeacae3a61e9aff039ca5670f0c14bc9c2f3f915ee28a0bdfbd2b1766bc9

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

41089f34dd04998818d313d244d13604.exe
Size

173KB
MD5

41089f34dd04998818d313d244d13604
SHA1

fce6527a9030c62173aac5df7283cf7fb86d8734
SHA256

31fbbeacae3a61e9aff039ca5670f0c14bc9c2f3f915ee28a0bdfbd2b1766bc9
SHA512

9c2836a8d832f1e98e8ed64988cda604ebaf1f5ba68bc9a98b788ec843efcdcf6e536ec4a8e328d6a968616677dab763b2d2608c194756b05617b1a5e24505be
SSDEEP

3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/18Fpjl:o68i3odBiTl2+TCU/al

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart"	41089f34dd04998818d313d244d13604.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SHARE_TEMP\Icon3.ico	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\winhash_up.exez	41089f34dd04998818d313d244d13604.exe
File opened for modification	C:\Windows\winhash_up.exez	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\winhash_up.exe	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\SHARE_TEMP\Icon2.ico	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\SHARE_TEMP\Icon7.ico	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\SHARE_TEMP\Icon10.ico	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\SHARE_TEMP\Icon14.ico	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\SHARE_TEMP\Icon5.ico	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\SHARE_TEMP\Icon12.ico	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\bugMAKER.bat	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\SHARE_TEMP\Icon6.ico	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\SHARE_TEMP\Icon13.ico	41089f34dd04998818d313d244d13604.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2728	3064	41089f34dd04998818d313d244d13604.exe	28
PID 3064 wrote to memory of 2728	3064	41089f34dd04998818d313d244d13604.exe	28
PID 3064 wrote to memory of 2728	3064	41089f34dd04998818d313d244d13604.exe	28
PID 3064 wrote to memory of 2728	3064	41089f34dd04998818d313d244d13604.exe	28

C:\Users\Admin\AppData\Local\Temp\41089f34dd04998818d313d244d13604.exe
"C:\Users\Admin\AppData\Local\Temp\41089f34dd04998818d313d244d13604.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\bugMAKER.bat
  2⤵
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\bugMAKER.bat

Filesize
76B

MD5
53fef2af90114aed9b70d31e691041b7

SHA1
eeef25ff39053a59990bf8c0203d3864de689b62

SHA256
39dd598307637ad885e77e284bd553d790f461756096eb55703ce8dd76f38f82

SHA512
92a78356a291b6869ddb800964c0598c0d2d96249e33ba8ccc1422b0d29688851222e3b11b59cfbd5397fe8cf9bfef1bbfc9054bfd0ed856dac909859ce57b1f

Download Submit
memory/2728-62-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/3064-67-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads