5cc2f5a6a21c1eaaef46e2e7b170c9352a2a13be4f109aa3b2507a645bc38f4e | Triage

Analysis

max time kernel
146s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 20:20

Sharing

Report Analysis Logs

General

Target

1376f757ec80c864a94cc7e625c6c46e.exe
Size

3.8MB
MD5

1376f757ec80c864a94cc7e625c6c46e
SHA1

bb6baf5801e58110d65de1fcfa8d2e3426e63a65
SHA256

5cc2f5a6a21c1eaaef46e2e7b170c9352a2a13be4f109aa3b2507a645bc38f4e
SHA512

e7049b4614891034a727095adf75fa9d9b4e6cd05c7a92e509597fd526be6f33c00f49ad3a4537dadda0a8a6e805961ac05322045e3b27850a632321428dfe65
SSDEEP

98304:9MuisPObuSn76tTTmL3W5+w85WxkTx5jfpSBndL+:u8k2QPWiSBR+

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2860	svchost.exe
2224	svchost.exe

Creates a Windows Service
persistence

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	1376f757ec80c864a94cc7e625c6c46e.exe
File opened for modification	C:\Windows\svchost.exe	1376f757ec80c864a94cc7e625c6c46e.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2492	1376f757ec80c864a94cc7e625c6c46e.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2492	1376f757ec80c864a94cc7e625c6c46e.exe
2860	svchost.exe
2224	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2224	2860	svchost.exe	31
PID 2860 wrote to memory of 2224	2860	svchost.exe	31
PID 2860 wrote to memory of 2224	2860	svchost.exe	31
PID 2860 wrote to memory of 2224	2860	svchost.exe	31

C:\Users\Admin\AppData\Local\Temp\1376f757ec80c864a94cc7e625c6c46e.exe
"C:\Users\Admin\AppData\Local\Temp\1376f757ec80c864a94cc7e625c6c46e.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2492

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2492-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download