Analysis

  • max time kernel
    118s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02-03-2024 23:24

General

  • Target

    MicrosoftWindowsServicesEtc/data/runner32s.exe

  • Size

    58KB

  • MD5

    87815289b110cf33af8af1decf9ff2e9

  • SHA1

    09024f9ec9464f56b7e6c61bdd31d7044bdf4795

  • SHA256

    a97ea879e2b51972aa0ba46a19ad4363d876ac035502a2ed2df27db522bc6ac4

  • SHA512

    8d9024507fa83f578b375c86f38970177313ec3dd9fae794b6e7f739e84fa047a9ef56bf190f6f131d0c7c5e280e729208848b152b3ca492a54af2b18e70f5dc

  • SSDEEP

    768:nfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQR:cIxKWLvFn43bovQtu7qo43jjRDf4e

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MicrosoftWindowsServicesEtc\data\runner32s.exe
    "C:\Users\Admin\AppData\Local\Temp\MicrosoftWindowsServicesEtc\data\runner32s.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Windows\system32\wscript.exe
      "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\5AEC.tmp\5AED.vbs
      2⤵
      • Drops file in Program Files directory
      PID:2928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\5AEC.tmp\5AED.vbs

    Filesize

    383B

    MD5

    5f427dc44f33906509423d24fa0590c0

    SHA1

    b896f7667381a594d3751e05f258925b81c231c0

    SHA256

    9aae0707b1d5d3b7ed3bf5cc8fbb530aebd195e3e2f18312f3f7f1aa43e031b4

    SHA512

    bd28c386772062ef945f24c8ad7a25f158856af36e31d2c9b14674cedfd34b4f48ed531cd40a7eb291384d83665ffe154f0786c1a7ee1616256cf30125120961