Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/02/2024, 19:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aa02bdfca6e8fd7d5d2b271362bb92c8.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
aa02bdfca6e8fd7d5d2b271362bb92c8.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
aa02bdfca6e8fd7d5d2b271362bb92c8.exe
-
Size
187KB
-
MD5
aa02bdfca6e8fd7d5d2b271362bb92c8
-
SHA1
72d92a049f9a0bb6232d29e864be80355ce17e35
-
SHA256
ed17c2e99c0b56f59b01c0c63b087be0ea2e2f83e1309427b3f8ec306d19e632
-
SHA512
04946fa29ce8defcf9aa899cda3b85a1d920347befa4c2008f68649b10ebe7cfcaae2131aa495c6318a2f9b6b30cfba600ef7abcc9ba64a5a8f725608a4538b1
-
SSDEEP
3072:2JqYEw1JU+EwHerM1sNKaGM5En561wulbnTcdnCkgw9XRgQSnEQ9R3nKY:2JtEwJjeM+NPxw56b7GgIXyQS79B
Score
8/10
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Loads dropped DLL 5 IoCs
pid Process 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\cryptdlg32.dll aa02bdfca6e8fd7d5d2b271362bb92c8.exe File created C:\Windows\SysWOW64\dot3dlg32.dll aa02bdfca6e8fd7d5d2b271362bb92c8.exe File created C:\Windows\SysWOW64\cscdll32.dll aa02bdfca6e8fd7d5d2b271362bb92c8.exe File created C:\Windows\SysWOW64\n4JG1DE7DJWsGEJ.vbs aa02bdfca6e8fd7d5d2b271362bb92c8.exe File created C:\Windows\SysWOW64\connect32.dll aa02bdfca6e8fd7d5d2b271362bb92c8.exe File created C:\Windows\SysWOW64\dmusic32.dll aa02bdfca6e8fd7d5d2b271362bb92c8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1368 wrote to memory of 1432 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 28 PID 1368 wrote to memory of 1432 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 28 PID 1368 wrote to memory of 1432 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 28 PID 1368 wrote to memory of 1432 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 28 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15 PID 1368 wrote to memory of 1200 1368 aa02bdfca6e8fd7d5d2b271362bb92c8.exe 15
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\aa02bdfca6e8fd7d5d2b271362bb92c8.exe"C:\Users\Admin\AppData\Local\Temp\aa02bdfca6e8fd7d5d2b271362bb92c8.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\system32\n4JG1DE7DJWsGEJ.vbs"3⤵PID:1432
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD526d4fea8f96fcdcbcc629e7c68d52139
SHA18de80904ded589f3a08045a8009c44f4f50884c2
SHA256d9c247700060e5de1ce9f175a2945d6332e7d7d3873499d9804da1ed1b2bdc6a
SHA512eb417f5970b97f9311af8d7e8199e005e4368d6a4ec76933dab008790a3e645d8daeed054dcab71f3c72db065850a18721d15401f15dfd04755d50630ad07445
-
Filesize
122KB
MD58793b5006da2fe16d480a71e9a9225b8
SHA1799f23e9e7b5b0195110983a55474df8fc381e0d
SHA2561f49f0ad33ec3988c3d101014db5f87d95bf247da5845f59d5ec9c578002b2b3
SHA512bba00506bddf422d41f024a628a3d6a980302780acf9e2680168c9deeb4edce9930d3a84bc2cc75064b18af4bb486a96b66dd1d3f1299502ef946ff4dd721452