Analysis

  • max time kernel
    143s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/02/2024, 02:40

General

  • Target

    96074841b8dd8bb15f3a9859bba79e7c.exe

  • Size

    4.3MB

  • MD5

    96074841b8dd8bb15f3a9859bba79e7c

  • SHA1

    4df22c0a4ffebb94cfb878f91b6d9c455554c234

  • SHA256

    ad6f1c3320c9147a178daedcde6d77896ca4d60ec3b113be0eea10b5d38770c3

  • SHA512

    3c5c3f443deff2d289b16ad31af2c5b9f679e23e579502a0246b3c8a93bf2f50cd93e90a45d0f3d89c01d3625bdadf7f07a6c44dd55e9939e0dfcad1c48878f4

  • SSDEEP

    98304:D3ga98rEvBBBBBBBqBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBd:D3Go

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\96074841b8dd8bb15f3a9859bba79e7c.exe
    "C:\Users\Admin\AppData\Local\Temp\96074841b8dd8bb15f3a9859bba79e7c.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\WINDOWS\SysWOW64\winsp II\Services.exe
      "C:\WINDOWS\system32\winsp II\Services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:2240

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\winsp II\Services.exe

          Filesize

          4.3MB

          MD5

          96074841b8dd8bb15f3a9859bba79e7c

          SHA1

          4df22c0a4ffebb94cfb878f91b6d9c455554c234

          SHA256

          ad6f1c3320c9147a178daedcde6d77896ca4d60ec3b113be0eea10b5d38770c3

          SHA512

          3c5c3f443deff2d289b16ad31af2c5b9f679e23e579502a0246b3c8a93bf2f50cd93e90a45d0f3d89c01d3625bdadf7f07a6c44dd55e9939e0dfcad1c48878f4

        • memory/2100-0-0x0000000002710000-0x0000000002711000-memory.dmp

          Filesize

          4KB

        • memory/2100-7-0x0000000000400000-0x000000000085D000-memory.dmp

          Filesize

          4.4MB

        • memory/2240-6-0x00000000027F0000-0x00000000027F1000-memory.dmp

          Filesize

          4KB

        • memory/2240-8-0x0000000000400000-0x000000000085D000-memory.dmp

          Filesize

          4.4MB

        • memory/2240-10-0x00000000027F0000-0x00000000027F1000-memory.dmp

          Filesize

          4KB

        • memory/2240-20-0x0000000000400000-0x000000000085D000-memory.dmp

          Filesize

          4.4MB

        • memory/2240-22-0x0000000000400000-0x000000000085D000-memory.dmp

          Filesize

          4.4MB