38ef6f40ff55bb9145a52ed767aef6bedbe38096b805959ffa1163926ed8a4b9 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 22:37

Sharing

Report Analysis Logs

General

Target

mpam-fe.exe
Size

132.8MB
MD5

4b6821ec6f39a6c7e4ed0da8f586c34c
SHA1

04d40bd4e9cd01f53b989e424fa519cb8f6f1b6d
SHA256

38ef6f40ff55bb9145a52ed767aef6bedbe38096b805959ffa1163926ed8a4b9
SHA512

9a28dd0033bb204e9a0d1fe6d08601c9d4fbf2d83febcf426a377bb574df85ee98a0b0e47e749d820b7c5e0c5670fc6f52bf7d1e45136b0ec383f3aa68922ff1
SSDEEP

3145728:Xk8NVmcXCRsfMRfcF+uvpAwliTMbJgjzRYdPYhGgJUIkTV:XkOVmcus0ZE+SpBliIdgj9YFYhGg2Tx

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2016	MpSigStub.exe

Loads dropped DLL 3 IoCs

pid	Process
2360	mpam-fe.exe
2360	mpam-fe.exe
2360	mpam-fe.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2360	mpam-fe.exe
2016	MpSigStub.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2016	2360	mpam-fe.exe	28
PID 2360 wrote to memory of 2016	2360	mpam-fe.exe	28
PID 2360 wrote to memory of 2016	2360	mpam-fe.exe	28

C:\Users\Admin\AppData\Local\Temp\mpam-fe.exe
"C:\Users\Admin\AppData\Local\Temp\mpam-fe.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\89BE56F7-D76B-43E4-8189-179A3D361707\MpSigStub.exe
  C:\Users\Admin\AppData\Local\Temp\89BE56F7-D76B-43E4-8189-179A3D361707\MpSigStub.exe /stub 1.1.23080.1001 /payload 1.403.1751.0 /program C:\Users\Admin\AppData\Local\Temp\mpam-fe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads