d09039c17434d523b01e13468ed9446dc26c9a8061875a654de8747605df20eb

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d09039c17434d523b01e13468ed9446dc26c9a8061875a654de8747605df20eb.exe
Size

151KB
MD5

82fa99987d4a4e4c6add3bfecddd43d9
SHA1

01a86a7262e5430b2b6ec0e88fe2e4e29497c148
SHA256

d09039c17434d523b01e13468ed9446dc26c9a8061875a654de8747605df20eb
SHA512

24d60f2c7fa8be61d28b95c941435209278304cc9f37835bd3e9ae41b1baf93271ee3b6352a4923d2acdf1e396133071d1092e9ffda5c75b327370038637532b
SSDEEP

1536:oOoq1XuNCQy7vm9iV+sW6VQcFa/SNmBtBneGr4qjOOiE5gVehKOjNrG58Z3qOT/w:SK66hW6k6uBneGEq6OiE5uehKyazo/w

Score

9^/10

persistence

Malware Config

Signatures

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
behavioral1/memory/2224-8-0x0000000000400000-0x000000000042F000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
1844	d09039c17434d523b01e13468ed9446dc26c9a8061875a654de8747605df20eb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe"	d09039c17434d523b01e13468ed9446dc26c9a8061875a654de8747605df20eb.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	d09039c17434d523b01e13468ed9446dc26c9a8061875a654de8747605df20eb.exe
File opened (read-only)	\??\B:	d09039c17434d523b01e13468ed9446dc26c9a8061875a654de8747605df20eb.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mshlta.exe	d09039c17434d523b01e13468ed9446dc26c9a8061875a654de8747605df20eb.exe
File created	C:\Windows\SysWOW64\mshlta.exe	d09039c17434d523b01e13468ed9446dc26c9a8061875a654de8747605df20eb.exe

C:\Users\Admin\AppData\Local\Temp\d09039c17434d523b01e13468ed9446dc26c9a8061875a654de8747605df20eb.exe
"C:\Users\Admin\AppData\Local\Temp\d09039c17434d523b01e13468ed9446dc26c9a8061875a654de8747605df20eb.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\ d09039c17434d523b01e13468ed9446dc26c9a8061875a654de8747605df20eb.exe
  "C:\Users\Admin\AppData\Local\Temp\ d09039c17434d523b01e13468ed9446dc26c9a8061875a654de8747605df20eb.exe"
  2⤵
  - Executes dropped EXE
  PID:1844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ d09039c17434d523b01e13468ed9446dc26c9a8061875a654de8747605df20eb.exe

Filesize
81KB

MD5
321b68d735ace871f0925934911044c1

SHA1
e8a5e39dddd1d595bdd43639c0ed1e6ffb537563

SHA256
f2fdb7bf291962f08f575b94a3701217fe35b74bfa389f4ef241246ffe2a61f9

SHA512
a7ce9f0d08076648c679871d04df52e2b91a93316922c586735ec8ace25d077cb798e465c79532f332f028b3c77e16eb8d7f3269bc9a374ffdbc97840fe0547b

Download Submit
memory/2224-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads