Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
09-01-2024 03:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d2f403fe0f23a67cb1ae46a264f20ec.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
4d2f403fe0f23a67cb1ae46a264f20ec.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
4d2f403fe0f23a67cb1ae46a264f20ec.exe
-
Size
43KB
-
MD5
4d2f403fe0f23a67cb1ae46a264f20ec
-
SHA1
637977adc22baf18cf47ff65e4d4d06c6d24e172
-
SHA256
4dbab4356827d58c1d7d7366128b06f4286905b45590b2ad3aaa55dfb3646745
-
SHA512
37660f842119d4dab563d677bb7468ab6bf88eb9a9159f66ce11210b42fd7d7165a2dc5e3fade03037eedf244389f8544b6fe6cafbb4a701f3e50c33c2a90774
-
SSDEEP
768:rQPnOX6XRd9PB71WC2pP4eMHA8gLa1hPsdWakcT8nqr3:rYzn9p5JUPcILaNy4n8
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run 4d2f403fe0f23a67cb1ae46a264f20ec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\ISHOST.EXE = "ISHOST.EXE" 4d2f403fe0f23a67cb1ae46a264f20ec.exe -
Executes dropped EXE 1 IoCs
pid Process 2416 ismini.exe -
Loads dropped DLL 2 IoCs
pid Process 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\ismini.exe 4d2f403fe0f23a67cb1ae46a264f20ec.exe File created C:\Windows\SysWOW64\components\flx0.dll 4d2f403fe0f23a67cb1ae46a264f20ec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2416 ismini.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2416 ismini.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2416 ismini.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2416 ismini.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2416 ismini.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2416 ismini.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2416 ismini.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2416 ismini.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2416 ismini.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2416 ismini.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2416 ismini.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2416 ismini.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2416 ismini.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2416 ismini.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2416 ismini.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2416 ismini.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 2416 ismini.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2416 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 28 PID 2228 wrote to memory of 2416 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 28 PID 2228 wrote to memory of 2416 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 28 PID 2228 wrote to memory of 2416 2228 4d2f403fe0f23a67cb1ae46a264f20ec.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d2f403fe0f23a67cb1ae46a264f20ec.exe"C:\Users\Admin\AppData\Local\Temp\4d2f403fe0f23a67cb1ae46a264f20ec.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\ismini.exeC:\Windows\system32\ismini.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2416
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD507826a10cf25d3766950b24901264b6c
SHA1bfa3eed48203bbcc7d9183f96818cf048e78e2df
SHA256427b8a0b66fc8cc8fba65743195cd228b9455db3b4ff06b84c7a51b225d48872
SHA512c12a1c0aa2465d5e92829e053f7ea96c256ce5c9cc7ad71334e1f568916843f503efccf7d7b26873c969fda1181db2828a36d36792a9e9d6d03702c14e9c8169