Analysis
- max time kernel
144s - max time network
123s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
13/02/2024, 06:32
General
- Target 98b81cbae65f05785b0781dc2f97ae81.exe
- Size 14.9MB
- Sample240213-ha37csch73
- SHA256 a65c40200fbb60a7b8aff743b5dc7c53684b0af90a071547e4ac6b525d02dff3
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\98b81cbae65f05785b0781dc2f97ae81.exe"C:\Users\Admin\AppData\Local\Temp\98b81cbae65f05785b0781dc2f97ae81.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\w.exeC:\Users\Admin\AppData\Local\Temp\w.exe -run C:\Users\Admin\AppData\Local\Temp\98b81cbae65f05785b0781dc2f97ae81.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
w.exe
w.exe
w.exe
w.exe
w.exe
memory/928-36-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-42-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-44-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-8-0x0000000000390000-0x0000000000391000-memory.dmp
memory/928-9-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/928-10-0x0000000000310000-0x0000000000311000-memory.dmp
memory/928-11-0x0000000002B00000-0x0000000002B02000-memory.dmp
memory/928-12-0x0000000000570000-0x0000000000571000-memory.dmp
memory/928-14-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/928-16-0x0000000000550000-0x0000000000551000-memory.dmp
memory/928-15-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/928-17-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/928-18-0x0000000000540000-0x0000000000541000-memory.dmp
memory/928-19-0x0000000000580000-0x0000000000581000-memory.dmp
memory/928-20-0x0000000000590000-0x0000000000591000-memory.dmp
memory/928-21-0x0000000001F50000-0x0000000001F51000-memory.dmp
memory/928-22-0x0000000001F00000-0x0000000001F01000-memory.dmp
memory/928-23-0x00000000005D0000-0x00000000005D1000-memory.dmp
memory/928-24-0x0000000001F30000-0x0000000001F31000-memory.dmp
memory/928-25-0x00000000005C0000-0x00000000005C1000-memory.dmp
memory/928-26-0x0000000001F20000-0x0000000001F21000-memory.dmp
memory/928-27-0x0000000001F60000-0x0000000001F61000-memory.dmp
memory/928-28-0x0000000001F40000-0x0000000001F41000-memory.dmp
memory/928-29-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/928-30-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-31-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-32-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-34-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-33-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-0-0x0000000000400000-0x0000000000536000-memory.dmp
memory/928-35-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-39-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-7-0x00000000002F0000-0x00000000002F1000-memory.dmp
memory/928-6-0x0000000000240000-0x0000000000241000-memory.dmp
memory/928-55-0x00000000003C0000-0x00000000003C1000-memory.dmp
memory/928-46-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-45-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-47-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-41-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-40-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-50-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-43-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-5-0x0000000000300000-0x0000000000301000-memory.dmp
memory/928-65-0x0000000000400000-0x0000000000536000-memory.dmp
memory/928-4-0x00000000002D0000-0x00000000002D1000-memory.dmp
memory/928-66-0x0000000000340000-0x0000000000390000-memory.dmp
memory/928-2-0x0000000000320000-0x0000000000321000-memory.dmp
memory/928-59-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/928-37-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-3-0x00000000002E0000-0x00000000002E1000-memory.dmp
memory/928-38-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-49-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-48-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-51-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-52-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-56-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/928-1-0x0000000000340000-0x0000000000390000-memory.dmp
memory/928-54-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/928-53-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/2864-72-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/2864-73-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/2864-69-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/2864-71-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/2864-70-0x0000000002BC0000-0x0000000002CC0000-memory.dmp
memory/2864-68-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/2864-132-0x0000000000400000-0x0000000000536000-memory.dmp