726117aa1aebcfd50982ca7f2c732094d278669d3390e84ea5f5b791ee02865f

Analysis

max time kernel
149s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 09:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f8752275db16d2826dc34298bb0ffc2.exe
Size

36KB
MD5

7f8752275db16d2826dc34298bb0ffc2
SHA1

6054564884a40da4ad41515606236fe3d77b6805
SHA256

726117aa1aebcfd50982ca7f2c732094d278669d3390e84ea5f5b791ee02865f
SHA512

c70eae28d978ea0fd9a0967ae0c0bb1b4d32d53762f4f2f4a6cdc77c84ed05b9a314668c131cdb1470d4adb8fe8d719beee7efb0b7d4a294c8987a47140a70a2
SSDEEP

384:xU1LS3JJbv1NpwMSI4YauAncwdpOmzwgZVmWa8mfetDysSoDlI:6S3Jl1N2ssomN39z1

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2548	IEHelp.exe

Loads dropped DLL 5 IoCs

pid	Process
1728	7f8752275db16d2826dc34298bb0ffc2.exe
2548	IEHelp.exe
2548	IEHelp.exe
2548	IEHelp.exe
2548	IEHelp.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\IEHelp.exe	7f8752275db16d2826dc34298bb0ffc2.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\IEHelp.exe	7f8752275db16d2826dc34298bb0ffc2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1728	7f8752275db16d2826dc34298bb0ffc2.exe
2548	IEHelp.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2548	1728	7f8752275db16d2826dc34298bb0ffc2.exe	28
PID 1728 wrote to memory of 2548	1728	7f8752275db16d2826dc34298bb0ffc2.exe	28
PID 1728 wrote to memory of 2548	1728	7f8752275db16d2826dc34298bb0ffc2.exe	28
PID 1728 wrote to memory of 2548	1728	7f8752275db16d2826dc34298bb0ffc2.exe	28
PID 1728 wrote to memory of 2548	1728	7f8752275db16d2826dc34298bb0ffc2.exe	28
PID 1728 wrote to memory of 2548	1728	7f8752275db16d2826dc34298bb0ffc2.exe	28
PID 1728 wrote to memory of 2548	1728	7f8752275db16d2826dc34298bb0ffc2.exe	28

C:\Users\Admin\AppData\Local\Temp\7f8752275db16d2826dc34298bb0ffc2.exe
"C:\Users\Admin\AppData\Local\Temp\7f8752275db16d2826dc34298bb0ffc2.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEHelp.exe
  "C:\Program Files (x86)\Internet Explorer\IEHelp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\at.lnk

Filesize
973B

MD5
72a7cff7471b48382dfbb1ef8bfe7626

SHA1
74439adad71e33eb8f64d84d5e67f792c524230f

SHA256
397114e667a9e66b6235ad3b08e39a9d460e21477851a62c395a4169de545fd2

SHA512
e445720bece56acb7f0273a7ab640c7c4ab984e11da546e72aae0abc1bb5724d87fe37158766a4bcd8e78c1e3c74bf6df67c0a868f0b316ac056a82a7379475b

Download Submit
\Program Files (x86)\Internet Explorer\IEHelp.exe

Filesize
36KB

MD5
7f8752275db16d2826dc34298bb0ffc2

SHA1
6054564884a40da4ad41515606236fe3d77b6805

SHA256
726117aa1aebcfd50982ca7f2c732094d278669d3390e84ea5f5b791ee02865f

SHA512
c70eae28d978ea0fd9a0967ae0c0bb1b4d32d53762f4f2f4a6cdc77c84ed05b9a314668c131cdb1470d4adb8fe8d719beee7efb0b7d4a294c8987a47140a70a2

Download Submit