Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23/01/2024, 19:00
Static task
static1
Behavioral task
behavioral1
Sample
7050c4053e466c58e67b0d8303f338ab.exe
Resource
win7-20231215-en
General
-
Target
7050c4053e466c58e67b0d8303f338ab.exe
-
Size
875KB
-
MD5
7050c4053e466c58e67b0d8303f338ab
-
SHA1
20f11fa8bf3e890a110468c410716fa4f5c57884
-
SHA256
14ef98932bc5fbb1c2ec62c2379757843edc781f4d5583eef14751874277ce0f
-
SHA512
5be9aeb67d9ee64b461c4dd500d0a600e1641421e823399a1ca1e56aa6f0c77d65ead1f80ad222a24a88f226addafa7607e7e0942fa9bfc97bf29633ae278446
-
SSDEEP
24576:BOMLKmtvPyHu7UtwdOy9pNg4W7HM8mcN+2QHCQX:QiKmHyO4tPp7s8LQB
Malware Config
Signatures
-
Loads dropped DLL 4 IoCs
pid Process 2484 7050c4053e466c58e67b0d8303f338ab.exe 2484 7050c4053e466c58e67b0d8303f338ab.exe 2484 7050c4053e466c58e67b0d8303f338ab.exe 2484 7050c4053e466c58e67b0d8303f338ab.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7050c4053e466c58e67b0d8303f338ab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3000 wrote to memory of 3048 3000 7050c4053e466c58e67b0d8303f338ab.exe 28 PID 3000 wrote to memory of 3048 3000 7050c4053e466c58e67b0d8303f338ab.exe 28 PID 3000 wrote to memory of 3048 3000 7050c4053e466c58e67b0d8303f338ab.exe 28 PID 3000 wrote to memory of 3048 3000 7050c4053e466c58e67b0d8303f338ab.exe 28 PID 3000 wrote to memory of 3048 3000 7050c4053e466c58e67b0d8303f338ab.exe 28 PID 3000 wrote to memory of 3048 3000 7050c4053e466c58e67b0d8303f338ab.exe 28 PID 3000 wrote to memory of 3048 3000 7050c4053e466c58e67b0d8303f338ab.exe 28 PID 3048 wrote to memory of 2484 3048 7050c4053e466c58e67b0d8303f338ab.exe 29 PID 3048 wrote to memory of 2484 3048 7050c4053e466c58e67b0d8303f338ab.exe 29 PID 3048 wrote to memory of 2484 3048 7050c4053e466c58e67b0d8303f338ab.exe 29 PID 3048 wrote to memory of 2484 3048 7050c4053e466c58e67b0d8303f338ab.exe 29 PID 3048 wrote to memory of 2484 3048 7050c4053e466c58e67b0d8303f338ab.exe 29 PID 3048 wrote to memory of 2484 3048 7050c4053e466c58e67b0d8303f338ab.exe 29 PID 3048 wrote to memory of 2484 3048 7050c4053e466c58e67b0d8303f338ab.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7050c4053e466c58e67b0d8303f338ab.exe"C:\Users\Admin\AppData\Local\Temp\7050c4053e466c58e67b0d8303f338ab.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\7050c4053e466c58e67b0d8303f338ab.exe"C:\Users\Admin\AppData\Local\Temp\7050c4053e466c58e67b0d8303f338ab.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\7050c4053e466c58e67b0d8303f338ab.exe"C:\Users\Admin\AppData\Local\Temp\7050c4053e466c58e67b0d8303f338ab.exe"3⤵
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2484
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD56d07371fc32a05058d034e32afe5db83
SHA122023abeb6d829f409ecd3463d8034549239a49c
SHA2561d9b3b58330262b04334986dd7748608ceb1f58641d6ce43c51d8663ed576385
SHA51219e94370cc4a1da0aa80584ecb95a2ff5c839d71e33042f95dbbd8e40f1b991e90b9abe965aaf0d639a9ca3b73572ef004f8764407352e94935fe2e6ef226478
-
Filesize
5KB
MD544dac7f87bdf94d553f8d2cf073d605d
SHA121bf5d714b9fcab32ba40ff7d36e48c378b67a06
SHA2560e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66
SHA51292c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774
-
Filesize
494KB
MD5f0c59526f8186eadaf2171b8fd2967c1
SHA18ffbe3e03d8139b50b41931c7b3360a0eebdb5cb
SHA2566e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6
SHA512dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854
-
Filesize
200KB
MD5a865a0c4ff5e036a811cecadc527471e
SHA1fabc08d74f38b79afbd07e0c426875d8d063996c
SHA2569242243de3bfc8fa082b1d972699592afc76ca67bc69ff7fe6026f748feae63e
SHA512bdcc2f150dd265ba5b8ad8a38fcbcde53a669308823bd4624cbad208e1c404c08a1426855dd230bbf95adc9d46e312c0470f7e90761aac265c1789d4099d9925