d5bff8474fab1c49324cae2253c6bba0f802592b0f14fbcc13624806e5367aef

Analysis

max time kernel
177s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-01-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7db7e97c3ce779a4b1fa90902f9c19e3.exe
Size

956KB
MD5

7db7e97c3ce779a4b1fa90902f9c19e3
SHA1

a6475070117cf1602affba6bbd1644d6b0dc0178
SHA256

d5bff8474fab1c49324cae2253c6bba0f802592b0f14fbcc13624806e5367aef
SHA512

5c199deb74e3f4b4c8e27ddd56d026e5b0de19971307f4bbd907484b8d42cdd19a1d8b060c31d51801c86b1178f788b22b744255f9bf5ec8354615895a443a23
SSDEEP

24576:JdYnl8+Z77rA/i503hVkjyCSFAhJuVg8lcCkz:JdY3prAKcQHPhAVDxkz

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2584	INS2240.tmp
3068	install.exe

Loads dropped DLL 8 IoCs

pid	Process
2848	7db7e97c3ce779a4b1fa90902f9c19e3.exe
2584	INS2240.tmp
2584	INS2240.tmp
2584	INS2240.tmp
1520	WerFault.exe
1520	WerFault.exe
1520	WerFault.exe
1520	WerFault.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adult Tube XXX codec\Antivirus\install.exe	INS2240.tmp
File opened for modification	C:\Program Files (x86)\Adult Tube XXX codec\Antivirus\codec.exe	INS2240.tmp
File opened for modification	C:\Program Files (x86)\Adult Tube XXX codec\Antivirus\install.48322.exe	INS2240.tmp
File opened for modification	C:\Program Files (x86)\Adult Tube XXX codec\Antivirus\dad.exe	INS2240.tmp
File opened for modification	C:\Program Files (x86)\Adult Tube XXX codec\Antivirus\setup.exe	INS2240.tmp
File opened for modification	C:\Program Files (x86)\Adult Tube XXX codec\Antivirus\service.exe	INS2240.tmp
File opened for modification	C:\Program Files (x86)\Adult Tube XXX codec\Antivirus\lol.exe	INS2240.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1520	3068	WerFault.exe	32

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2584	2848	7db7e97c3ce779a4b1fa90902f9c19e3.exe	29
PID 2848 wrote to memory of 2584	2848	7db7e97c3ce779a4b1fa90902f9c19e3.exe	29
PID 2848 wrote to memory of 2584	2848	7db7e97c3ce779a4b1fa90902f9c19e3.exe	29
PID 2848 wrote to memory of 2584	2848	7db7e97c3ce779a4b1fa90902f9c19e3.exe	29
PID 2848 wrote to memory of 2584	2848	7db7e97c3ce779a4b1fa90902f9c19e3.exe	29
PID 2848 wrote to memory of 2584	2848	7db7e97c3ce779a4b1fa90902f9c19e3.exe	29
PID 2848 wrote to memory of 2584	2848	7db7e97c3ce779a4b1fa90902f9c19e3.exe	29
PID 2584 wrote to memory of 3068	2584	INS2240.tmp	32
PID 2584 wrote to memory of 3068	2584	INS2240.tmp	32
PID 2584 wrote to memory of 3068	2584	INS2240.tmp	32
PID 2584 wrote to memory of 3068	2584	INS2240.tmp	32
PID 2584 wrote to memory of 3068	2584	INS2240.tmp	32
PID 2584 wrote to memory of 3068	2584	INS2240.tmp	32
PID 2584 wrote to memory of 3068	2584	INS2240.tmp	32
PID 3068 wrote to memory of 1520	3068	install.exe	33
PID 3068 wrote to memory of 1520	3068	install.exe	33
PID 3068 wrote to memory of 1520	3068	install.exe	33
PID 3068 wrote to memory of 1520	3068	install.exe	33

C:\Users\Admin\AppData\Local\Temp\7db7e97c3ce779a4b1fa90902f9c19e3.exe
"C:\Users\Admin\AppData\Local\Temp\7db7e97c3ce779a4b1fa90902f9c19e3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\INS2240.tmp
  "C:\Users\Admin\AppData\Local\Temp\INS2240.tmp"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Program Files (x86)\Adult Tube XXX codec\Antivirus\install.exe
    "C:\Program Files (x86)\Adult Tube XXX codec\Antivirus\install.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 36
      4⤵
      Loads dropped DLL
      Program crash
      PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adult Tube XXX codec\Antivirus\install.exe

Filesize
82KB

MD5
07b99fd0f00ea9229de4ce5dc76f9e27

SHA1
4085b9e60725eab338059230816ffd361249bed0

SHA256
9e06f29cfdceaf21ef441e3bf1a000a3d0fb0e06e0b71632334715ceb8c01df1

SHA512
e57fba6796ef48ed1e91a74fc0904773482d53785e0664d661870ccac8f4954fd3ebbd2170fb45cb0e0fd64114522b84eb7588c52ee688b38fba5a51d04739e9

Download Submit
\Users\Admin\AppData\Local\Temp\INS2240.tmp

Filesize
951KB

MD5
b10d8fb9732dad00203b9b0b53e22f01

SHA1
5cf36298529b7b6d0fe92a6596cbe758fc4577f6

SHA256
785ae107fb18fddf7f3b08dc31a0b5144ad123293d439c4bb8b004766a11ed31

SHA512
3f71a924212e8eb9a6ec46a610c145d743bf8c5473c5a8f566cdc26c6980551304c0196c4148edb8d155639d4c3a0aa79566f9235e5ee0efe68ac9f77d2c0f79

Download Submit
memory/2584-53-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2848-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2848-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-48-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download