f01f937fa03e4791786dd0bc2b775f4109a23082963641cc327cd3caef5fe95d

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 15:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8cb552217b4b3d6094a3d0f8e9d8cdfb.exe
Size

4.8MB
MD5

8cb552217b4b3d6094a3d0f8e9d8cdfb
SHA1

087d26cddb54d0b51192e311fa117b2ac35facbd
SHA256

f01f937fa03e4791786dd0bc2b775f4109a23082963641cc327cd3caef5fe95d
SHA512

ca68db4ee8ce1e5eff8efd8a92f544aec1410ac5aaabbdf1f0fc218818662c32e15569a09627379b3189d3d2f45d4d30f14f61d8c2637ed40d690bf8a3cdec13
SSDEEP

98304:ayysADIbjztONWLAlllprWLJgIZdEPNfFWnVxCb0qNPQq8ZdH:lysADIbgW4P6ZXElgVHsPL8ZdH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2656	8cb552217b4b3d6094a3d0f8e9d8cdfb.exe
2656	8cb552217b4b3d6094a3d0f8e9d8cdfb.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	8cb552217b4b3d6094a3d0f8e9d8cdfb.exe
File opened (read-only)	\??\B:	8cb552217b4b3d6094a3d0f8e9d8cdfb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\8cb552217b4b3d6094a3d0f8e9d8cdfb.exe
"C:\Users\Admin\AppData\Local\Temp\8cb552217b4b3d6094a3d0f8e9d8cdfb.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~vis0000\English.vlg

Filesize
10KB

MD5
2f5fd0039e54e90d8c77020094ba5835

SHA1
4b5633c2de8cabe1a0f62ba8a5289c073326b31f

SHA256
920d6ea0fb774d0ee065739ad1aff269f98ae55d01a77bb2080e55a2be75f9a3

SHA512
f29f19926446d633f46b2e37e57680c71a2cdbd465b5c2d2955a4afa694b0d967024b24283af99a7321b74c2874c2ddd287e524af6d3062420b83102b997f90d

Download Submit
\Users\Admin\AppData\Local\Temp\~vis0000\jpeg.dll

Filesize
104KB

MD5
0da8449291b80aac6c6f7e356d14ba36

SHA1
421456596c690b69d262dcb5e96f474c3c92ab14

SHA256
c83e2f98b9182073002b24c731f9fe0512bc4a3b468181c677d20fc465218232

SHA512
4e99332b791a7629d8541fce0e3d56d3452168abbbe5e56e38d79edb440bf1e12ca2d73d2f79d78a5c2ba282ab3ff84103691153fe26da670e9a9a28f75713ac

Download Submit
\Users\Admin\AppData\Local\Temp\~vis0000\vise32ex.dll

Filesize
496KB

MD5
ec6736ff6e49d30c998de60055aa7819

SHA1
f8c729e7cb896286e364b9fccc227298effb4e9e

SHA256
d5e0c8cbe9e0c274260f6c8484dcdfd7cb5ba9ef094f3f7a7951bb4b92bc2193

SHA512
58d3f0df653cd83ba63bc46adeff587f736d79ab7f275d03bfb1aa4709afae0ef456a1e2597e407ef07e67ae84a9689184fbde8d4a7964716a14f21f865e9d8a

Download Submit
memory/2656-49-0x0000000000390000-0x00000000003AB000-memory.dmp

Filesize
108KB

Download