Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe
Resource
win10v2004-20240226-en
General
-
Target
2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe
-
Size
359KB
-
MD5
c8cafbcd86fb5fa3c657523005020aff
-
SHA1
9a81678a4a71688868ed8af2f4d0921882dba9d5
-
SHA256
2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff
-
SHA512
06c88fdb8e84a88aaddda6c46342276bcb73c9b2a64e5acf0fc3daab58f96d92090477b681bc002d0370bbb05a81c2f2eb874f1296de8d38a5e14ffbf8ceccf2
-
SSDEEP
6144:ztvBPnU1b7e9SQii1EkoNlhlrQ2ZrM2xQcSGemVd7bI:Zv1nWdQP1EDhZPxQlmT7s
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2300 Isass.exe 2736 AK_2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe -
Loads dropped DLL 3 IoCs
pid Process 2284 2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe 2284 2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe 2284 2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Program Files (x86)\\Microsoft Build\\Isass.exe" 2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Program Files (x86)\\Microsoft Build\\Isass.exe" 2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Build\Isass.exe 2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2284 2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe 2300 Isass.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2300 2284 2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe 28 PID 2284 wrote to memory of 2300 2284 2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe 28 PID 2284 wrote to memory of 2300 2284 2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe 28 PID 2284 wrote to memory of 2300 2284 2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe 28 PID 2284 wrote to memory of 2736 2284 2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe 29 PID 2284 wrote to memory of 2736 2284 2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe 29 PID 2284 wrote to memory of 2736 2284 2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe 29 PID 2284 wrote to memory of 2736 2284 2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe"C:\Users\Admin\AppData\Local\Temp\2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Program Files (x86)\Microsoft Build\Isass.exe"C:\Program Files (x86)\Microsoft Build\Isass.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2300
-
-
C:\Users\Admin\AppData\Local\Temp\AK_2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe"C:\Users\Admin\AppData\Local\Temp\AK_2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe"2⤵
- Executes dropped EXE
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AK_2c4b9526560dc6da89a37bcec2eef6e0a23cc90028ae77dcaf8344138743bfff.exe
Filesize142KB
MD581a7c181639679983efb07c2dea2ebd0
SHA193370e8e5cb0d89bf6786445f94dd02dbb84b574
SHA2568320c7f90f65b48e4031b680506a9579751789ded4d90fa2fbfc2fb7db7e3ec8
SHA512599cca13e527c92cdf88df06ed8a01eee1bc602c565ab69e251f7414e19833ce42f0453771bfdf27d16f9f70112835b599d26a6ed92901fdf86bbdf8adf4d2f7
-
Filesize
213KB
MD558f9e911b4f1ba7c52787e8403734643
SHA14a912d75be4d67c735643048293e9736c41926c1
SHA256d2da6cdb0749963a805bff0b6fc85d028f70ca25d2673549552af06bc35bb3a8
SHA5124c325e42e4c70120f57f49e7f08a29f38a2cb906375ec23e855f9cae6363cdcc7340cc6b3e1ab2b6d293ec0bc877d6dc86783ecaf255cdef7cea3768bc7ee433