5cc2f5a6a21c1eaaef46e2e7b170c9352a2a13be4f109aa3b2507a645bc38f4e | Triage

Analysis

max time kernel
163s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 20:20

Sharing

Report Analysis Logs

General

Target

1376f757ec80c864a94cc7e625c6c46e.exe
Size

3.8MB
MD5

1376f757ec80c864a94cc7e625c6c46e
SHA1

bb6baf5801e58110d65de1fcfa8d2e3426e63a65
SHA256

5cc2f5a6a21c1eaaef46e2e7b170c9352a2a13be4f109aa3b2507a645bc38f4e
SHA512

e7049b4614891034a727095adf75fa9d9b4e6cd05c7a92e509597fd526be6f33c00f49ad3a4537dadda0a8a6e805961ac05322045e3b27850a632321428dfe65
SSDEEP

98304:9MuisPObuSn76tTTmL3W5+w85WxkTx5jfpSBndL+:u8k2QPWiSBR+

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4840	svchost.exe
4064	svchost.exe

Creates a Windows Service
persistence

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	1376f757ec80c864a94cc7e625c6c46e.exe
File opened for modification	C:\Windows\svchost.exe	1376f757ec80c864a94cc7e625c6c46e.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1704	1376f757ec80c864a94cc7e625c6c46e.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1704	1376f757ec80c864a94cc7e625c6c46e.exe
4840	svchost.exe
4064	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4064	4840	svchost.exe	61
PID 4840 wrote to memory of 4064	4840	svchost.exe	61
PID 4840 wrote to memory of 4064	4840	svchost.exe	61

C:\Users\Admin\AppData\Local\Temp\1376f757ec80c864a94cc7e625c6c46e.exe
"C:\Users\Admin\AppData\Local\Temp\1376f757ec80c864a94cc7e625c6c46e.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1704

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svchost.exe

Filesize
92KB

MD5
ed735641b33fd83c4fa849351ba9831c

SHA1
c29174b35ee7292f4aefbc2062d3a5e46c8f7000

SHA256
5cce3be31aa6d35dc69a1b8f2f6d9d07c6636d364885120397e5c7c69930b4c3

SHA512
d1a17368b8e6d7289c33c166ec7e24965582011d2ebcdfbd29dddae34bc14bda14ee942c08c94bbab3e6e5f8de6dc0bb5e72ccc09b5d0e542eefe4a92602270f

Download Submit
memory/1704-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download