37f8ec0c7788b458d69999ed5ba30080c53588c9ae3f9b080acf7114c7457cf4

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8d605f9d7ce8338457d8020bbec72a3.exe
Size

34KB
MD5

c8d605f9d7ce8338457d8020bbec72a3
SHA1

5f707df7e97ad75487e0a436c03d0725b0323c63
SHA256

37f8ec0c7788b458d69999ed5ba30080c53588c9ae3f9b080acf7114c7457cf4
SHA512

763b316b1511a942ea6d08644f319684f07692f1e64e5061e6e1d6302b68901bc0d69fbc7db6900f072f96f75edb103e399975e1c1bdfecb5314e779de3a52c4
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunIVpeNs23mAA6lqTX:bA74zYcgT/Ekd0ryfjPIunqpeNswmxTX

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2168	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
1716	c8d605f9d7ce8338457d8020bbec72a3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2168	1716	c8d605f9d7ce8338457d8020bbec72a3.exe	28
PID 1716 wrote to memory of 2168	1716	c8d605f9d7ce8338457d8020bbec72a3.exe	28
PID 1716 wrote to memory of 2168	1716	c8d605f9d7ce8338457d8020bbec72a3.exe	28
PID 1716 wrote to memory of 2168	1716	c8d605f9d7ce8338457d8020bbec72a3.exe	28

C:\Users\Admin\AppData\Local\Temp\c8d605f9d7ce8338457d8020bbec72a3.exe
"C:\Users\Admin\AppData\Local\Temp\c8d605f9d7ce8338457d8020bbec72a3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
35KB

MD5
2d52d0ed86cae1eb72f691950dead2a9

SHA1
f5d8b43e461097f119cff83a28fc3b10acce0189

SHA256
a9c98ca8fed4ad22037281ace73cd872d7b4c4fae3269e10d917cd5c3bf768ce

SHA512
479bf5afc42faa3d8d0deab733ca6d05491ffb36f5b353d254895dd56e0c88b4a483f588394f63bd15e1515b72353a5aa209d641c9e849c18375a50d9c2e057a

Download Submit
memory/1716-0-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download
memory/1716-1-0x0000000001CF0000-0x0000000001CF6000-memory.dmp

Filesize
24KB

Download
memory/1716-8-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download
memory/2168-15-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2168-17-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download