fe30d03e8801ad1b72b0acd1a8c74b224b691c35185bff36a203aff4d7cfe393

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

A-Recovery.exe
Size

1.0MB
MD5

2bcbba5775ae7fbd3cb905384ba94541
SHA1

e40e6638a107f2b3e3220847ac941e921e19996c
SHA256

0320c62f6a850bdc2cca1be0aad8cb57c5470682e51d39be435616b9401fa94f
SHA512

d7b5b1c6216fc9020f9ae10a961085af264a7d3f2ee58a1fceb6c268ebe770ffae92aca2b8804b1f914cdc2c14e7d211220da3a5e91765f67f02fa983dcb87b1
SSDEEP

24576:U2UMqwnKNQkLvDwY1gFp49axV87Psa9ev0HRsVgHHz:U2aUX2P7iErHz

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2168	A-Recovery.tmp

Loads dropped DLL 3 IoCs

pid	Process
2180	A-Recovery.exe
2168	A-Recovery.tmp
2168	A-Recovery.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2168	A-Recovery.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2168	2180	A-Recovery.exe	28
PID 2180 wrote to memory of 2168	2180	A-Recovery.exe	28
PID 2180 wrote to memory of 2168	2180	A-Recovery.exe	28
PID 2180 wrote to memory of 2168	2180	A-Recovery.exe	28
PID 2180 wrote to memory of 2168	2180	A-Recovery.exe	28
PID 2180 wrote to memory of 2168	2180	A-Recovery.exe	28
PID 2180 wrote to memory of 2168	2180	A-Recovery.exe	28

C:\Users\Admin\AppData\Local\Temp\A-Recovery.exe
"C:\Users\Admin\AppData\Local\Temp\A-Recovery.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\is-CLEO2.tmp\A-Recovery.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-CLEO2.tmp\A-Recovery.tmp" /SL5="$5001C,764611,142848,C:\Users\Admin\AppData\Local\Temp\A-Recovery.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-CLEO2.tmp\A-Recovery.tmp

Filesize
751KB

MD5
11d09ed09c773a37489d2b6da4194e10

SHA1
0999a14167a1077c6e98abc71808982906befc45

SHA256
dcafe09d2c25fc8168542840f7a6355f8ee8ed74c68f7988a6f65589e4f9957a

SHA512
a07e23f007d9c36eec069ab4c4ebc6e56e4c0b14e6b8838e40deea44d3e59589149961fd1eccf4c189b665b47b47f813ecbad801f1c44a7820b80f64672c1d09

Download Submit
\Users\Admin\AppData\Local\Temp\is-PKRJB.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/2168-9-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2168-18-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/2168-21-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2180-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2180-17-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download