6906dc833ce2cab16aeb42ea56ce5e027e7e12e08a9ff03417390b2eb45f67f1

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/UnStrFunc.exe
Size

58KB
MD5

44bb778209750cffb4fecfec65066404
SHA1

7b9df7f43bfd8823725ac496bae6dd04ae2dba5c
SHA256

a12d8ad081655636c7599b43ca74fc01bcbe8137f00a911ad1e85fcc8aee2071
SHA512

1c503f402263e703f5db38cb6f5c61db5e198b6c3b5916a888804e0d064fec3bd58106fbbd279c827813e60eda3c56e03dc307d1d3b55cab495ebed798b3049c
SSDEEP

1536:cVAn9tHIaEgtwRWr0DLXlxuxdV1z0YpV0woxE+1V:cStoaEZDLXlxuxtz0YzoPV

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2996	Un_A.exe

Loads dropped DLL 2 IoCs

pid	Process
3068	UnStrFunc.exe
2996	Un_A.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2996	Un_A.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2996	3068	UnStrFunc.exe	27
PID 3068 wrote to memory of 2996	3068	UnStrFunc.exe	27
PID 3068 wrote to memory of 2996	3068	UnStrFunc.exe	27
PID 3068 wrote to memory of 2996	3068	UnStrFunc.exe	27

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UnStrFunc.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UnStrFunc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy99FF.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
58KB

MD5
44bb778209750cffb4fecfec65066404

SHA1
7b9df7f43bfd8823725ac496bae6dd04ae2dba5c

SHA256
a12d8ad081655636c7599b43ca74fc01bcbe8137f00a911ad1e85fcc8aee2071

SHA512
1c503f402263e703f5db38cb6f5c61db5e198b6c3b5916a888804e0d064fec3bd58106fbbd279c827813e60eda3c56e03dc307d1d3b55cab495ebed798b3049c

Download Submit