038a1fc6e36f117766abb1957554a7a96da3858812050e0ce2ac894dea87c766

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b301d372b96b89314b207d87438577be.exe
Size

39KB
MD5

b301d372b96b89314b207d87438577be
SHA1

d6c927efbfb21d596cd97a686784df72b5e7b737
SHA256

038a1fc6e36f117766abb1957554a7a96da3858812050e0ce2ac894dea87c766
SHA512

ad55b11724b02a18c9b642567dc9d37549ada023c377f5655cc9de9bd3b5c62bc7a622304620eb997032810f367de14d8c1f57378f288091e8c861f7ba1c142a
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf0w3sp8u5cZnfX2B:bgX4zYcgTEu6QOaryfjqDDw3sCu5mXm

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2512	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
1372	b301d372b96b89314b207d87438577be.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 2512	1372	b301d372b96b89314b207d87438577be.exe	28
PID 1372 wrote to memory of 2512	1372	b301d372b96b89314b207d87438577be.exe	28
PID 1372 wrote to memory of 2512	1372	b301d372b96b89314b207d87438577be.exe	28
PID 1372 wrote to memory of 2512	1372	b301d372b96b89314b207d87438577be.exe	28

C:\Users\Admin\AppData\Local\Temp\b301d372b96b89314b207d87438577be.exe
"C:\Users\Admin\AppData\Local\Temp\b301d372b96b89314b207d87438577be.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
39KB

MD5
ef3d1f12b048065b0e19b3570853de0d

SHA1
ca58e9273439f8796e1f8593f54c84ae226b887b

SHA256
1a1d70b2e53c2f62717b941f7206c9b7b69f89b108e743358ec6b45f99999863

SHA512
7afa1c02ffed525be702c43e308f5224a5fde9746571243e16fd4950c5a58dd9a7f9405102cc26a3c177887b6e62844596f06ff87858130e888199be5d181d64

Download Submit
memory/1372-0-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1372-5-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1372-1-0x0000000000570000-0x0000000000576000-memory.dmp

Filesize
24KB

Download
memory/2512-15-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2512-19-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download