e56c3eed11cf94d29ac1c24369887112b374e3053b371cafbbab9bc176e12b77

Analysis

max time kernel
123s
max time network
54s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 23:27

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

51e9ae4378cb38ff331ad95f35cba605.exe
Size

660KB
MD5

51e9ae4378cb38ff331ad95f35cba605
SHA1

8b37a8eb9536972a6bada81d92c109f76ef4b292
SHA256

e56c3eed11cf94d29ac1c24369887112b374e3053b371cafbbab9bc176e12b77
SHA512

5da0a8dc125c2d2cd23ab737e0d9b7a1ee65b21629bbdc867f6890d3a93c20f0c03784184c31a4953a62fb2a4c4e7ff05a81901185db1e3848dc7d61aba845ba
SSDEEP

12288:h8Rjc7UCAIf16KRBhc0ddzKwNkjOaOJ1zoKjquWO:ShNKf166c0dY9EyKOv

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2124	2964	51e9ae4378cb38ff331ad95f35cba605.exe	27
PID 2964 wrote to memory of 2124	2964	51e9ae4378cb38ff331ad95f35cba605.exe	27
PID 2964 wrote to memory of 2124	2964	51e9ae4378cb38ff331ad95f35cba605.exe	27
PID 2964 wrote to memory of 2124	2964	51e9ae4378cb38ff331ad95f35cba605.exe	27

C:\Users\Admin\AppData\Local\Temp\51e9ae4378cb38ff331ad95f35cba605.exe
"C:\Users\Admin\AppData\Local\Temp\51e9ae4378cb38ff331ad95f35cba605.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2124-5-0x000000006F720000-0x000000006FCCB000-memory.dmp

Filesize
5.7MB

Download
memory/2124-7-0x000000006F720000-0x000000006FCCB000-memory.dmp

Filesize
5.7MB

Download
memory/2964-0-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2964-1-0x0000000000320000-0x00000000003CC000-memory.dmp

Filesize
688KB

Download
memory/2964-2-0x0000000004B40000-0x0000000004B80000-memory.dmp

Filesize
256KB

Download
memory/2964-6-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download