Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    08/01/2024, 03:41

General

  • Target

    4a58343be43aabd8208f96368dd71d4a.exe

  • Size

    201KB

  • MD5

    4a58343be43aabd8208f96368dd71d4a

  • SHA1

    0effc69355fd92c7e323636ba69cdcc52f8acbcd

  • SHA256

    31eacd3117d660daf79e221ac449d77b7bb8f216871cc749ade733361b307c04

  • SHA512

    046a9119960e5651b4061e21cb6450520c3f920dcc5616ee211c36e5143a84e9add025b94181e3032799053e243122f3a8a5c5d21d4f9ba68127fd067edc7368

  • SSDEEP

    3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B8epjBFy11AwA:o68i3odBiTl2+TCU/lhuhuIc

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a58343be43aabd8208f96368dd71d4a.exe
    "C:\Users\Admin\AppData\Local\Temp\4a58343be43aabd8208f96368dd71d4a.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\bugMAKER.bat
      2⤵
        PID:3052

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\bugMAKER.bat

            Filesize

            76B

            MD5

            624c0b02fc3786bc1fe11308fa5c4b9d

            SHA1

            aeeef34030f30a6363b3e6669fb2a78214329fda

            SHA256

            9cdd23f204c83a989bd8ff8c3b6db08e1da0d9cd759ca0b69147d03aa8ca634c

            SHA512

            724db6ded73c24b015330f1ce44778eaecebac235ac13db4fd99a43c841cfe57b5e4f2839418929def4236c6996e63f91126b0f54b52c4f1dd54be54a2c9379c

          • memory/2960-67-0x0000000000400000-0x000000000042D000-memory.dmp

            Filesize

            180KB

          • memory/3052-62-0x00000000007A0000-0x00000000007A1000-memory.dmp

            Filesize

            4KB