1fdb4c3d83d707f399a4d721f3350d5ae01545a4ba06998259dba8b3b1886e8c

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fdb4c3d83d707f399a4d721f3350d5ae01545a4ba06998259dba8b3b1886e8c.exe
Size

2.3MB
MD5

7e9667a8146d3338f001a66d9845daa2
SHA1

2ffbf169e41fa9759891d3d314156e0125325a67
SHA256

1fdb4c3d83d707f399a4d721f3350d5ae01545a4ba06998259dba8b3b1886e8c
SHA512

b05722e1e889867aecba0b504615371ef38c6cf31866b138b39f8f528dd7b15a98a47065e0eff5bfe59edfb6c304992410a80985617df68a737e6b02ff991695
SSDEEP

49152:pN4D+rOBMQe8ywfzIS6+N8t96i9+HxT29iAjWVai/ZB3kbuRNQbKgF/3:pN4D0O+nwfzISE9T2xAS3kbujgp

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2080	gpu.exe

Loads dropped DLL 1 IoCs

pid	Process
1992	1fdb4c3d83d707f399a4d721f3350d5ae01545a4ba06998259dba8b3b1886e8c.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000016cf6-2.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2080	gpu.exe
2080	gpu.exe
2080	gpu.exe
2080	gpu.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2080	gpu.exe
2080	gpu.exe
2080	gpu.exe
2080	gpu.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2080	1992	1fdb4c3d83d707f399a4d721f3350d5ae01545a4ba06998259dba8b3b1886e8c.exe	28
PID 1992 wrote to memory of 2080	1992	1fdb4c3d83d707f399a4d721f3350d5ae01545a4ba06998259dba8b3b1886e8c.exe	28
PID 1992 wrote to memory of 2080	1992	1fdb4c3d83d707f399a4d721f3350d5ae01545a4ba06998259dba8b3b1886e8c.exe	28
PID 1992 wrote to memory of 2080	1992	1fdb4c3d83d707f399a4d721f3350d5ae01545a4ba06998259dba8b3b1886e8c.exe	28

C:\Users\Admin\AppData\Local\Temp\1fdb4c3d83d707f399a4d721f3350d5ae01545a4ba06998259dba8b3b1886e8c.exe
"C:\Users\Admin\AppData\Local\Temp\1fdb4c3d83d707f399a4d721f3350d5ae01545a4ba06998259dba8b3b1886e8c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Administrator\lgx\gpu.exe
  "C:\Users\Administrator\lgx\gpu.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Administrator\lgx\gpu.exe

Filesize
1.0MB

MD5
e83cbcd2ac2f1034e0d16e05619f2370

SHA1
3dacb5acc91ecbc434b7f206affa0651e8e0275f

SHA256
6eb154f3cc161daa9978d609e4c53e4432075634dd0849fddfd31c66a135f5c4

SHA512
c318445cc3900ea494ae8175f7d7345cbb2f09c2b18608d9694b249a90c32c566060d3c48cc726f1642d1d6dcc5da6310f87d077ed3220bcacafd96a9c2eefe1

Download Submit