b345610cc9392c5d14287e8e5dc00923f29cc5980e4b056cf62473761f00791c

Resubmissions

28/02/2024, 13:58

240228-q962asdc8y 10

28/02/2024, 13:52

240228-q6j3csdb58 10

Analysis

max time kernel
71s
max time network
67s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2868-2-0x0000000000230000-0x0000000000266000-memory.dmp
Size

216KB
MD5

55606281c5514f3ca5efe586d6275b16
SHA1

3fb435f32aa2f114dcaa817c6f8763a8e490ce53
SHA256

b345610cc9392c5d14287e8e5dc00923f29cc5980e4b056cf62473761f00791c
SHA512

1f21defd5a11f20db46704444531222048b5583e34132eb011046456e71f48a6398b548cc2ae62fc74deee75625dfee097873be9d09675081f0b52eb8d6f2418
SSDEEP

3072:j07AkGT31oD0yJWwIBuqzIOS8EKtck4I/jnItToLG/1vDMc4wL8ERlJ7K34Mb:g0kKo4yxIoqUOnUk4GItzD2O6oo

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3056	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 3056	2812	cmd.exe	29
PID 2812 wrote to memory of 3056	2812	cmd.exe	29
PID 2812 wrote to memory of 3056	2812	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2868-2-0x0000000000230000-0x0000000000266000-memory.dmp
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\2868-2-0x0000000000230000-0x0000000000266000-memory.dmp
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...