3345649a64b4a343e5357b396ad60c226025677951f953164f3e790470cc9197

Analysis

max time kernel
148s
max time network
144s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a9d6bb05f6ab13fad45fb46e4e973cb.exe
Size

308KB
MD5

8a9d6bb05f6ab13fad45fb46e4e973cb
SHA1

6ff4870ae53854c6ccfa06b1b215707e835ae4b2
SHA256

3345649a64b4a343e5357b396ad60c226025677951f953164f3e790470cc9197
SHA512

277a8471829925f8896440b0e657353ca47644b3377eee46ea40cb2fab21204e9a6c11bcd07ac4ae36f6704a92e9005cb6e6e43a1efbc6828acae94f1cacc7b7
SSDEEP

6144:p80F1X+xgbbu3WWIe/7d2rTo1NnHyZG/L3MIm:pHTX+xgPle/7d2PonSZwQ

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\F2Day\f2dmain.exe	8a9d6bb05f6ab13fad45fb46e4e973cb.exe
File created	C:\Program Files (x86)\F2Day\f2dux.exe	8a9d6bb05f6ab13fad45fb46e4e973cb.exe
File created	C:\Program Files (x86)\F2Day\f2dupdater.exe	8a9d6bb05f6ab13fad45fb46e4e973cb.exe
File opened for modification	C:\Program Files (x86)\F2Day\f2dux.exe	8a9d6bb05f6ab13fad45fb46e4e973cb.exe
File opened for modification	C:\Program Files (x86)\F2Day\f2dalimi.exe	8a9d6bb05f6ab13fad45fb46e4e973cb.exe
File created	C:\Program Files (x86)\F2Day\f2ddll.dll	8a9d6bb05f6ab13fad45fb46e4e973cb.exe
File created	C:\Program Files (x86)\F2Day\f2dmain.exe	8a9d6bb05f6ab13fad45fb46e4e973cb.exe
File created	C:\Program Files (x86)\F2Day\f2ddel.exe	8a9d6bb05f6ab13fad45fb46e4e973cb.exe
File opened for modification	C:\Program Files (x86)\F2Day\f2ddel.exe	8a9d6bb05f6ab13fad45fb46e4e973cb.exe
File created	C:\Program Files (x86)\F2Day\f2dico.ico	8a9d6bb05f6ab13fad45fb46e4e973cb.exe
File opened for modification	C:\Program Files (x86)\F2Day\f2dupdater.exe	8a9d6bb05f6ab13fad45fb46e4e973cb.exe
File created	C:\Program Files (x86)\F2Day\f2dalimi.exe	8a9d6bb05f6ab13fad45fb46e4e973cb.exe
File opened for modification	C:\Program Files (x86)\F2Day\f2dico.ico	8a9d6bb05f6ab13fad45fb46e4e973cb.exe
File opened for modification	C:\Program Files (x86)\F2Day\f2ddll.dll	8a9d6bb05f6ab13fad45fb46e4e973cb.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\delf2ddll.exe	8a9d6bb05f6ab13fad45fb46e4e973cb.exe
File opened for modification	C:\Windows\delf2ddll.exe	8a9d6bb05f6ab13fad45fb46e4e973cb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2760	8a9d6bb05f6ab13fad45fb46e4e973cb.exe
2760	8a9d6bb05f6ab13fad45fb46e4e973cb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	8a9d6bb05f6ab13fad45fb46e4e973cb.exe
Token: SeDebugPrivilege	2760	8a9d6bb05f6ab13fad45fb46e4e973cb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2760	8a9d6bb05f6ab13fad45fb46e4e973cb.exe
2760	8a9d6bb05f6ab13fad45fb46e4e973cb.exe

C:\Users\Admin\AppData\Local\Temp\8a9d6bb05f6ab13fad45fb46e4e973cb.exe
"C:\Users\Admin\AppData\Local\Temp\8a9d6bb05f6ab13fad45fb46e4e973cb.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads