adea5fcadcc48867b549d3963f3f2ddcb46ea4b6b31441e4126ca4f09653fd6f

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HA_NetworkScanner31_WGL.exe
Size

1.6MB
MD5

e75bb22df518a595100020464cb3c36d
SHA1

6fb2e092910fae5fbc57eeb8167a8d132ede37b8
SHA256

3c5efd271f161eadc9526dd331e41efabe02d78a29abf4498c8d38f3fe9362b4
SHA512

1e97ffba5812e56c993b809efa571aaf0080c1367a614b663db412bd5377dfdff956267d922e886257f3ff3b08cb3f81e2cc8602aee5e746755ab352574d8093
SSDEEP

49152:B6dKCSOcK0N7f1am/cO4C/uBJIM51HUTJ8d:kdx0BfE5O4CcaOd

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3720	is-M4TQE.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 3720	3992	HA_NetworkScanner31_WGL.exe	95
PID 3992 wrote to memory of 3720	3992	HA_NetworkScanner31_WGL.exe	95
PID 3992 wrote to memory of 3720	3992	HA_NetworkScanner31_WGL.exe	95

C:\Users\Admin\AppData\Local\Temp\HA_NetworkScanner31_WGL.exe
"C:\Users\Admin\AppData\Local\Temp\HA_NetworkScanner31_WGL.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Users\Admin\AppData\Local\Temp\is-7CH36.tmp\is-M4TQE.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7CH36.tmp\is-M4TQE.tmp" /SL4 $B0050 "C:\Users\Admin\AppData\Local\Temp\HA_NetworkScanner31_WGL.exe" 1389763 72704
  2⤵
  - Executes dropped EXE
  PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1332 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-7CH36.tmp\is-M4TQE.tmp

Filesize
656KB

MD5
69c66d1add37a646768cebcc958596c2

SHA1
c2018243dfe654bc70b9eefd9069b91be914406b

SHA256
4924545a8983a732951cc5c99a6b0365e5d98ad5f655e9abb3770031a8b3af6f

SHA512
ab59bcf5b9d1ebfedb5e4e90bf37164d7273329ce198acce5f0f2d1b5f03c7c5f244842a4fa281974aeaa90e7c3462ac1a6a864b6d5b2f2af033858c3b4ecc25

Download Submit
memory/3720-6-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/3720-12-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/3720-15-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/3992-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3992-11-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download