Analysis

  • max time kernel
    142s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    08/01/2024, 04:13

General

  • Target

    4a68e03ee1cfc5f1286cb5df49daba14.exe

  • Size

    1.4MB

  • MD5

    4a68e03ee1cfc5f1286cb5df49daba14

  • SHA1

    3f36dec45c66c6dd2aef63d7c12e3d4627e44888

  • SHA256

    16e5226713f696f2349a47666206a0ccf5b2e55c68a9523941a35d6ad0e7ac3c

  • SHA512

    1ba2bdbf0c96de5701d95be3325b066921ece002a305b21701983d6445f9934b1379d6247a4b2d5add4f493ed33e91d2bb11bfe1a40f67e2dab11c33f8da38da

  • SSDEEP

    24576:2YTbnsTIccZdCBV+pFtL2b+mdusgTk5BUw191rLr0ajI1t17V6I0Twt:LsTIbdCPbbiCz177I1t1IICg

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a68e03ee1cfc5f1286cb5df49daba14.exe
    "C:\Users\Admin\AppData\Local\Temp\4a68e03ee1cfc5f1286cb5df49daba14.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Users\Admin\AppData\Local\Temp\ijtmp_21706FB3-A78F-4255-8497-FDF3DA90123C\4a68e03ee1cfc5f1286cb5df49daba14.exe
      C:\Users\Admin\AppData\Local\Temp\ijtmp_21706FB3-A78F-4255-8497-FDF3DA90123C\4a68e03ee1cfc5f1286cb5df49daba14.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2128

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\ijtmp_21706FB3-A78F-4255-8497-FDF3DA90123C\4a68e03ee1cfc5f1286cb5df49daba14.exe

          Filesize

          1.4MB

          MD5

          4a68e03ee1cfc5f1286cb5df49daba14

          SHA1

          3f36dec45c66c6dd2aef63d7c12e3d4627e44888

          SHA256

          16e5226713f696f2349a47666206a0ccf5b2e55c68a9523941a35d6ad0e7ac3c

          SHA512

          1ba2bdbf0c96de5701d95be3325b066921ece002a305b21701983d6445f9934b1379d6247a4b2d5add4f493ed33e91d2bb11bfe1a40f67e2dab11c33f8da38da

        • \Users\Admin\AppData\Local\Temp\twapi-dlls-1.1.5\twapi.dll

          Filesize

          412KB

          MD5

          19f53fb243ad97ee855e6ecf0d12cc39

          SHA1

          ef56ef5320c622571ae5db69a66e592f32077411

          SHA256

          d88c5401e55d66bf7b8c42650644567ff27b35c6178c197af9fea941c8820301

          SHA512

          94acf9b6b2cae0cc49717fb8c5e5808facd9eca4e7409d695337d16e997bcbbcb110741307f689505465b395cc1b9b945d1518470c44d048fe6ed31c62879935

        • \Users\Admin\AppData\Local\Temp\twapi-dlls-1.1.5\twapicallback.dll

          Filesize

          56KB

          MD5

          5c9bdfd0977db0bb36c968045d95051b

          SHA1

          7b8a733ff048f17508a5a93cc95e4fc777be13f8

          SHA256

          6d6461d5b3cb5dd1f07611f2bb36766ad414d3883ad92c6bb3d8817f3f06c0bc

          SHA512

          fb3f3a7cd1bd7e3930cf4682c13103846561345023a9e9c750cebfd30f5a0a0abd19fffa78a0184a74e9d274be91bb7fffc662210411d6c42d78db8bcebee0bd

        • memory/1980-23-0x0000000000400000-0x0000000000606000-memory.dmp

          Filesize

          2.0MB

        • memory/1980-2-0x0000000000350000-0x0000000000352000-memory.dmp

          Filesize

          8KB

        • memory/1980-0-0x0000000000400000-0x0000000000606000-memory.dmp

          Filesize

          2.0MB

        • memory/1980-1-0x0000000001100000-0x0000000001306000-memory.dmp

          Filesize

          2.0MB

        • memory/1980-13-0x0000000003310000-0x0000000003516000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-17-0x0000000000370000-0x0000000000372000-memory.dmp

          Filesize

          8KB

        • memory/2128-32-0x0000000000400000-0x0000000000606000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-16-0x0000000000D60000-0x0000000000F66000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-27-0x0000000002790000-0x00000000027F7000-memory.dmp

          Filesize

          412KB

        • memory/2128-15-0x0000000000D60000-0x0000000000F66000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-14-0x0000000000D60000-0x0000000000F66000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-29-0x0000000000400000-0x0000000000606000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-30-0x0000000000400000-0x0000000000606000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-31-0x0000000000400000-0x0000000000606000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-19-0x0000000000400000-0x0000000000606000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-33-0x0000000000400000-0x0000000000606000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-34-0x0000000000400000-0x0000000000606000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-35-0x0000000000400000-0x0000000000606000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-36-0x0000000000400000-0x0000000000606000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-37-0x0000000000400000-0x0000000000606000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-38-0x0000000000400000-0x0000000000606000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-39-0x0000000000400000-0x0000000000606000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-40-0x0000000000400000-0x0000000000606000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-41-0x0000000000400000-0x0000000000606000-memory.dmp

          Filesize

          2.0MB

        • memory/2128-42-0x0000000000400000-0x0000000000606000-memory.dmp

          Filesize

          2.0MB