1f8055c5c7b1a80288fd37f7ca125f582ffac6fa46fa7a73549ce110112db23e

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1f8055c5c7b1a80288fd37f7ca125f582ffac6fa46fa7a73549ce110112db23e.exe
Size

1.2MB
MD5

4ad7e2c4b96c95be44534ffd546b29b5
SHA1

f2c72e5e84a0eee4041d35911d512b705a6fad73
SHA256

1f8055c5c7b1a80288fd37f7ca125f582ffac6fa46fa7a73549ce110112db23e
SHA512

a49d3008da955d459baf415ff1b764ece956c77e78755058b585c85fbe21bee405231078709f79b2716c96321d51121f66944165aaad068239df51795e274d27
SSDEEP

24576:NMr2R+wPCkP+dR117nn80wlab9TPxfarGid0FP7:+ryP9+V1jTw85arnd0FP7

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SpoonInstaller.TMP	1f8055c5c7b1a80288fd37f7ca125f582ffac6fa46fa7a73549ce110112db23e.exe
File created	C:\Program Files (x86)\SpoonInstaller.TMP	1f8055c5c7b1a80288fd37f7ca125f582ffac6fa46fa7a73549ce110112db23e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3016	1f8055c5c7b1a80288fd37f7ca125f582ffac6fa46fa7a73549ce110112db23e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 3016	2204	1f8055c5c7b1a80288fd37f7ca125f582ffac6fa46fa7a73549ce110112db23e.exe	28
PID 2204 wrote to memory of 3016	2204	1f8055c5c7b1a80288fd37f7ca125f582ffac6fa46fa7a73549ce110112db23e.exe	28
PID 2204 wrote to memory of 3016	2204	1f8055c5c7b1a80288fd37f7ca125f582ffac6fa46fa7a73549ce110112db23e.exe	28
PID 2204 wrote to memory of 3016	2204	1f8055c5c7b1a80288fd37f7ca125f582ffac6fa46fa7a73549ce110112db23e.exe	28

C:\Users\Admin\AppData\Local\Temp\1f8055c5c7b1a80288fd37f7ca125f582ffac6fa46fa7a73549ce110112db23e.exe
"C:\Users\Admin\AppData\Local\Temp\1f8055c5c7b1a80288fd37f7ca125f582ffac6fa46fa7a73549ce110112db23e.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\1f8055c5c7b1a80288fd37f7ca125f582ffac6fa46fa7a73549ce110112db23e.exe
  "C:\Users\Admin\AppData\Local\Temp\1f8055c5c7b1a80288fd37f7ca125f582ffac6fa46fa7a73549ce110112db23e.exe" --selfrun --IsElevated="C:\Users\Admin\AppData\Local\Temp\SPI11B2.tmp"
  2⤵
  - Drops file in Program Files directory
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SPI120A.tmp\setup.dat

Filesize
2KB

MD5
127ac8ba1e19fba9afc9a26c13a3cdd7

SHA1
26f504feb9f2f7b31e6b3411bb66f1bd15e54ed9

SHA256
bdf5c55cd41a9519749fab9d9573aa0725a35db4a61d3cff59e7adb87d271e3e

SHA512
d8e5f23161cd2ad6d97af01a37e6b6c646e71e48903828315db54b2eab122b3accbdc9d445ce4a5398db47fa05f33b5b41357787ea69f0d28f7be3082c700ac2

Download Submit