e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 17:14

Target

e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766.exe
Size

32KB
MD5

d513beb2bac27c307c3ac5a5a501dc66
SHA1

34adc018f611f65572dafed37518418832aad994
SHA256

e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766
SHA512

f09569379f22c24cc5d7e169404b85fd01ba93573098c729c84db89900982901c1f88c2cb29a9986490ba72487e3f0f917279672ee18354165fbb9d535c7cf5b
SSDEEP

768:C2gQ2nGtvZmI1yK0gEBYsuii6bEarouRwe2oTyoGETDA7vyWD2IpdN:qQh+I14gbm8uR1LAjdfrN

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766.exe\""	e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1264	2896	WerFault.exe	27

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2784	2896	e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766.exe	29
PID 2896 wrote to memory of 2784	2896	e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766.exe	29
PID 2896 wrote to memory of 2784	2896	e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766.exe	29
PID 2896 wrote to memory of 2784	2896	e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766.exe	29
PID 2896 wrote to memory of 1264	2896	e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766.exe	31
PID 2896 wrote to memory of 1264	2896	e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766.exe	31
PID 2896 wrote to memory of 1264	2896	e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766.exe	31
PID 2896 wrote to memory of 1264	2896	e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766.exe	31

C:\Users\Admin\AppData\Local\Temp\e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766.exe
"C:\Users\Admin\AppData\Local\Temp\e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766.exe
  "C:\Users\Admin\AppData\Local\Temp\e40fbde08891baf1f1ce86d879d02a32d2a007368e65348155a298079e2b8766.exe" n2896
  2⤵
  PID:2928
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:2784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 192
  2⤵
  - Program crash
  PID:1264