Overview

overview

10

Static

static

7

00FAEE82AB...AD.exe

windows7-x64

10

0B8E9BC319...20.exe

windows7-x64

10

0c9fa52ace...7a.exe

windows7-x64

7

15f7ea290d...8c.exe

windows7-x64

10

1DD70E8036...25.exe

windows7-x64

10

1E229029B2...DA.exe

windows7-x64

10

21977fc851...61.exe

windows7-x64

10

21e1bc4340...01.exe

windows7-x64

7

2272954a2c...5a.exe

windows7-x64

10

2C3542B5D9...85.exe

windows7-x64

7

3ac7f91e37...38.exe

windows7-x64

10

3c0fe521f6...16.exe

windows7-x64

10

41c53e90f0...4a.exe

windows7-x64

10

467c2b23b7...be.exe

windows7-x64

10

5b79b6a814...b0.exe

windows7-x64

10

712affaa8b...1).exe

windows7-x64

1

72716d15ea...21.exe

windows7-x64

7

8b04af13b7...21.exe

windows7-x64

10

Bit Paymer.exe

windows7-x64

10

KeepCalm.exe

windows7-x64

1

LockedIn.exe

windows7-x64

1

Purge.exe

windows7-x64

1

Scarab.exe

windows7-x64

10

a631ad1b1a...4b.exe

windows7-x64

6

a9053a3a52...bc.exe

windows7-x64

7

b764629e1f...1c.exe

windows7-x64

10

cf89f70633...5c.exe

windows7-x64

1

e951e82867...50.exe

windows7-x64

1

fa0c321e1a...d2.exe

windows7-x64

9

fc184274ad...27.exe

windows7-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16-03-2024 15:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a631ad1b1a59001a5f594880c6ae3337bda98f8ce3bb46cd7a9de0b35cd2bc4b.exe

  • Size

    272KB

  • MD5

    cb4ef16070b2dec59effcdb4a2134a83

  • SHA1

    c9fcc72c08eece9ca0beb2a3d3801bbfffcb6196

  • SHA256

    a631ad1b1a59001a5f594880c6ae3337bda98f8ce3bb46cd7a9de0b35cd2bc4b

  • SHA512

    be87293a1b9537d54780639006b6e7a6048755064ca4e78cc295ae1b6263ab4d511e4f720f2687a55372da10e8fd67a47bb091bd5357c50045690936b2411091

  • SSDEEP

    6144:1xIPLPHOoW/EHVDJSBD94vqW6Q65Ln1ZEVNl999999999999999999999POU:+DHOVcHVDJMgX6Qu0V

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a631ad1b1a59001a5f594880c6ae3337bda98f8ce3bb46cd7a9de0b35cd2bc4b.exe
    "C:\Users\Admin\AppData\Local\Temp\a631ad1b1a59001a5f594880c6ae3337bda98f8ce3bb46cd7a9de0b35cd2bc4b.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of FindShellTrayWindow
    PID:2896

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2896-0-0x0000000002B10000-0x0000000002E4E000-memory.dmp
    Filesize

    3.2MB

    Download
  • memory/2896-1-0x0000000002B10000-0x0000000002E4E000-memory.dmp
    Filesize

    3.2MB

    Download
  • memory/2896-2-0x00000000003A0000-0x00000000003A1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2896-3-0x0000000002B10000-0x0000000002E4E000-memory.dmp
    Filesize

    3.2MB

    Download
  • memory/2896-4-0x00000000003A0000-0x00000000003A1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2896-5-0x0000000012860000-0x00000000128AA000-memory.dmp
    Filesize

    296KB

    Download
  • memory/2896-6-0x0000000012860000-0x00000000128AA000-memory.dmp
    Filesize

    296KB

    Download
  • memory/2896-7-0x00000000003A0000-0x00000000003A1000-memory.dmp
    Filesize

    4KB

    Download