3b3aeb211e94f51e5f33329e5b5d949a1fcf905f55912ad65e8826e162269665

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e7606fc748735d244e8c0155851a0da.exe
Size

255KB
MD5

4e7606fc748735d244e8c0155851a0da
SHA1

b79a602372110d56e41fb8848b859d634e25c2ac
SHA256

3b3aeb211e94f51e5f33329e5b5d949a1fcf905f55912ad65e8826e162269665
SHA512

c83928afcb31ec496bf3c9cac126ce1ad99781be867648418c659134a57a991a10d47b9558aedde7413573fec83e1b1a24b7c70c399eb5caed454a12ff4d58a2
SSDEEP

3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/k8ZtkaVpjBFyi:o68i3odBiTl2+TCU/5tk8huhuIpRL5uP

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart"	4e7606fc748735d244e8c0155851a0da.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SHARE_TEMP\Icon13.ico	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\winhash_up.exez	4e7606fc748735d244e8c0155851a0da.exe
File opened for modification	C:\Windows\winhash_up.exez	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\SHARE_TEMP\Icon7.ico	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\SHARE_TEMP\Icon10.ico	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\bugMAKER.bat	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\SHARE_TEMP\Icon5.ico	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\SHARE_TEMP\Icon6.ico	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\SHARE_TEMP\Icon3.ico	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\SHARE_TEMP\Icon14.ico	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\winhash_up.exe	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\SHARE_TEMP\Icon2.ico	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\SHARE_TEMP\Icon12.ico	4e7606fc748735d244e8c0155851a0da.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2588	2940	4e7606fc748735d244e8c0155851a0da.exe	16
PID 2940 wrote to memory of 2588	2940	4e7606fc748735d244e8c0155851a0da.exe	16
PID 2940 wrote to memory of 2588	2940	4e7606fc748735d244e8c0155851a0da.exe	16
PID 2940 wrote to memory of 2588	2940	4e7606fc748735d244e8c0155851a0da.exe	16

C:\Users\Admin\AppData\Local\Temp\4e7606fc748735d244e8c0155851a0da.exe
"C:\Users\Admin\AppData\Local\Temp\4e7606fc748735d244e8c0155851a0da.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\bugMAKER.bat
  2⤵
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\bugMAKER.bat

Filesize
76B

MD5
9b99cae44d58e5cb6332e5a03e9f6043

SHA1
9b538de68e19226403c5735dee987bedf236056b

SHA256
b8edf4c31099124539998aafbe140a974f4678f80b369096e2f0d65331dcaa41

SHA512
91fb42cc1a849cee35b8f443fd19c2214055f8dfd3dfd9499a25bbeca13ad38de0dead97f9ab56dd5157f9c653ba08f0efbad6f63ad1eefdd63660aaf4a0c5c1

Download Submit
memory/2588-62-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2940-67-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads