6906dc833ce2cab16aeb42ea56ce5e027e7e12e08a9ff03417390b2eb45f67f1

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6906dc833ce2cab16aeb42ea56ce5e027e7e12e08a9ff03417390b2eb45f67f1.exe
Size

72KB
MD5

c9204ebf4894ab01cf96f707d30ed481
SHA1

b795dcb154d4c6aaca34a83d13bff60acb98ce55
SHA256

6906dc833ce2cab16aeb42ea56ce5e027e7e12e08a9ff03417390b2eb45f67f1
SHA512

db59f8f4a944caa93362a492050c1565768993aa5697011394d082a9d7b2a2d6d1914f751e13b78fab75f10707529548a4277e30014c0498b894077ed779614a
SSDEEP

1536:cVAn9tHIaEgtwRWr0DLXlxuuUcuW0AxE+19Hdj0n02HHW:cStoaEZDLXlxuudTP9yfW

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2872	UnStrFunc.exe

Loads dropped DLL 3 IoCs

pid	Process
2388	6906dc833ce2cab16aeb42ea56ce5e027e7e12e08a9ff03417390b2eb45f67f1.exe
2388	6906dc833ce2cab16aeb42ea56ce5e027e7e12e08a9ff03417390b2eb45f67f1.exe
2872	UnStrFunc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2872	UnStrFunc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2872	2388	6906dc833ce2cab16aeb42ea56ce5e027e7e12e08a9ff03417390b2eb45f67f1.exe	28
PID 2388 wrote to memory of 2872	2388	6906dc833ce2cab16aeb42ea56ce5e027e7e12e08a9ff03417390b2eb45f67f1.exe	28
PID 2388 wrote to memory of 2872	2388	6906dc833ce2cab16aeb42ea56ce5e027e7e12e08a9ff03417390b2eb45f67f1.exe	28
PID 2388 wrote to memory of 2872	2388	6906dc833ce2cab16aeb42ea56ce5e027e7e12e08a9ff03417390b2eb45f67f1.exe	28

C:\Users\Admin\AppData\Local\Temp\6906dc833ce2cab16aeb42ea56ce5e027e7e12e08a9ff03417390b2eb45f67f1.exe
"C:\Users\Admin\AppData\Local\Temp\6906dc833ce2cab16aeb42ea56ce5e027e7e12e08a9ff03417390b2eb45f67f1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\nsi1787.tmp\UnStrFunc.exe
  "C:\Users\Admin\AppData\Local\Temp\nsi1787.tmp\UnStrFunc.exe" _?=C:\Users\Admin\AppData\Local\Temp\nsi1787.tmp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsi1787.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
\Users\Admin\AppData\Local\Temp\nsi1787.tmp\UnStrFunc.exe

Filesize
58KB

MD5
44bb778209750cffb4fecfec65066404

SHA1
7b9df7f43bfd8823725ac496bae6dd04ae2dba5c

SHA256
a12d8ad081655636c7599b43ca74fc01bcbe8137f00a911ad1e85fcc8aee2071

SHA512
1c503f402263e703f5db38cb6f5c61db5e198b6c3b5916a888804e0d064fec3bd58106fbbd279c827813e60eda3c56e03dc307d1d3b55cab495ebed798b3049c

Download Submit