38d3eed64bb20d1b66dca4a298adca6370d2d2ee82e59985532f9009798b6274

Analysis

max time kernel
143s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e02f640286a6f1f21b3ec13bf4d89235.exe
Size

147KB
MD5

e02f640286a6f1f21b3ec13bf4d89235
SHA1

8c5004af690737f9b536325fbf9285669d8941b4
SHA256

38d3eed64bb20d1b66dca4a298adca6370d2d2ee82e59985532f9009798b6274
SHA512

98be7c455d92c513771e030e7e5e9d94a71cd591b7260334aae04b83a6cdc6dc77678f3ab03a77be7510d0a05b0cad3a83ef67a0358a54199d586bb95919635d
SSDEEP

3072:5xqtou73+ZfYBMGdSuwbpah+5BJlgZfYoE:DG+ZwBMWKpx5BJaZwf

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1808	server.exe
2496	v11f.exe

Loads dropped DLL 8 IoCs

pid	Process
2236	e02f640286a6f1f21b3ec13bf4d89235.exe
2236	e02f640286a6f1f21b3ec13bf4d89235.exe
2236	e02f640286a6f1f21b3ec13bf4d89235.exe
2236	e02f640286a6f1f21b3ec13bf4d89235.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	v11f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	v11f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2500	1808	WerFault.exe	28

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1808	2236	e02f640286a6f1f21b3ec13bf4d89235.exe	28
PID 2236 wrote to memory of 1808	2236	e02f640286a6f1f21b3ec13bf4d89235.exe	28
PID 2236 wrote to memory of 1808	2236	e02f640286a6f1f21b3ec13bf4d89235.exe	28
PID 2236 wrote to memory of 1808	2236	e02f640286a6f1f21b3ec13bf4d89235.exe	28
PID 2236 wrote to memory of 2496	2236	e02f640286a6f1f21b3ec13bf4d89235.exe	30
PID 2236 wrote to memory of 2496	2236	e02f640286a6f1f21b3ec13bf4d89235.exe	30
PID 2236 wrote to memory of 2496	2236	e02f640286a6f1f21b3ec13bf4d89235.exe	30
PID 2236 wrote to memory of 2496	2236	e02f640286a6f1f21b3ec13bf4d89235.exe	30
PID 1808 wrote to memory of 2500	1808	server.exe	29
PID 1808 wrote to memory of 2500	1808	server.exe	29
PID 1808 wrote to memory of 2500	1808	server.exe	29
PID 1808 wrote to memory of 2500	1808	server.exe	29

C:\Users\Admin\AppData\Local\Temp\e02f640286a6f1f21b3ec13bf4d89235.exe
"C:\Users\Admin\AppData\Local\Temp\e02f640286a6f1f21b3ec13bf4d89235.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 88
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2500
- C:\Users\Admin\AppData\Local\Temp\v11f.exe
  "C:\Users\Admin\AppData\Local\Temp\v11f.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\server.exe

Filesize
69KB

MD5
3f3603e52b0e61fd35b625fba6130229

SHA1
d12ebb80f130dd5453385c05ddce25b3b60dec9b

SHA256
427e417a115fa88447fd1f71b40ed112bdb6ea45efb86125f7e5fe3dd5f23552

SHA512
9d99306dacb431116ba7a87db916d2df0bad13d38dfa070d09a75fa20f4321f7aefe159c8a9c394272b0a9184548d0a423ccade2aeb313f163ee11195a5f6ec6

Download Submit
\Users\Admin\AppData\Local\Temp\v11f.exe

Filesize
38KB

MD5
c3b81c5f84e67fbf2dbd264711db8e9d

SHA1
a22c823948b4e6b8863de5c50eaba6b267c56817

SHA256
ff1e7a19253ac58988bfca4b75a1afa330bc2970de6eacb7161277919f675c20

SHA512
d38a15d1e878f622d19112f5388c5b6c237638590704062f31ebc7659f7253d5f6c6d5d218a371b097384cef10d845e36b8d3061ade78f6a0f3e700bcf1d6b1d

Download Submit
memory/1808-13-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2236-3-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2236-11-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download