153181d3c740cc476c771bbdc6045da1ccc8e0fdd52d47866a01c262477759de

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

432a4e313281a412dc21622da6cb50b5.exe
Size

99KB
MD5

432a4e313281a412dc21622da6cb50b5
SHA1

3958aec8c3618f7a1986cbe331be1b22dcea1bd3
SHA256

153181d3c740cc476c771bbdc6045da1ccc8e0fdd52d47866a01c262477759de
SHA512

e7de7393eddebd700b75700630047382cb3a8bf4ecf8468d6a790429e7b8c1122241991dcffd613a9dc5d1370991e7519278005454a1b6cd98621fe12b3c1a3a
SSDEEP

1536:w/VkVncgzS8GzYI2fq3iRMgLGmQQrNJ1BrOEifcv4UZBxna5Lh1I3CbRlbbr8L2u:tTrDMcv4UZBxny1N/br8aYqY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1936	d5hg2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\d5hg2.exe	432a4e313281a412dc21622da6cb50b5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2624	1936	WerFault.exe
2620	2548	WerFault.exe	15

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 1936	2548	432a4e313281a412dc21622da6cb50b5.exe	23
PID 2548 wrote to memory of 1936	2548	432a4e313281a412dc21622da6cb50b5.exe	23
PID 2548 wrote to memory of 1936	2548	432a4e313281a412dc21622da6cb50b5.exe	23
PID 2548 wrote to memory of 1936	2548	432a4e313281a412dc21622da6cb50b5.exe	23
PID 1936 wrote to memory of 2624	1936	d5hg2.exe	22
PID 1936 wrote to memory of 2624	1936	d5hg2.exe	22
PID 1936 wrote to memory of 2624	1936	d5hg2.exe	22
PID 1936 wrote to memory of 2624	1936	d5hg2.exe	22
PID 2548 wrote to memory of 2620	2548	432a4e313281a412dc21622da6cb50b5.exe	32
PID 2548 wrote to memory of 2620	2548	432a4e313281a412dc21622da6cb50b5.exe	32
PID 2548 wrote to memory of 2620	2548	432a4e313281a412dc21622da6cb50b5.exe	32
PID 2548 wrote to memory of 2620	2548	432a4e313281a412dc21622da6cb50b5.exe	32

C:\Users\Admin\AppData\Local\Temp\432a4e313281a412dc21622da6cb50b5.exe
"C:\Users\Admin\AppData\Local\Temp\432a4e313281a412dc21622da6cb50b5.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\d5hg2.exe
  "C:\Windows\d5hg2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 800
  2⤵
  - Program crash
  PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 576
1⤵
- Program crash
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\d5hg2.exe

Filesize
58KB

MD5
be3dcc3ab2500f662e02676f78d6a98d

SHA1
7025e0381622cc35f9a0a602a35ccc401ebd3405

SHA256
24265d8439f398a8d58fe88db2672cf79a652f911ecfdd302ddbc60d630c3188

SHA512
25f50eb2a973a48fe65a8d9cd3d41db424c5ef81815e29e105c852b20a1c16ec30b025e6a2d87c359ad1c9f53a15c5ceff5b0a86bc30bb5d3166f3946159bf2d

Download Submit
memory/1936-10-0x0000000000AD0000-0x0000000000AE6000-memory.dmp

Filesize
88KB

Download
memory/1936-11-0x0000000074EA0000-0x000000007558E000-memory.dmp

Filesize
6.9MB

Download
memory/1936-14-0x0000000074EA0000-0x000000007558E000-memory.dmp

Filesize
6.9MB

Download
memory/2548-0-0x0000000000A90000-0x0000000000AAE000-memory.dmp

Filesize
120KB

Download
memory/2548-1-0x0000000074EA0000-0x000000007558E000-memory.dmp

Filesize
6.9MB

Download
memory/2548-3-0x0000000004B80000-0x0000000004BC0000-memory.dmp

Filesize
256KB

Download
memory/2548-2-0x0000000000200000-0x0000000000214000-memory.dmp

Filesize
80KB

Download
memory/2548-12-0x0000000074EA0000-0x000000007558E000-memory.dmp

Filesize
6.9MB

Download
memory/2548-13-0x0000000004B80000-0x0000000004BC0000-memory.dmp

Filesize
256KB

Download