Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24-04-2024 21:34
Static task
static1
Behavioral task
behavioral1
Sample
4e004cb79ab58c24f48a68f1b9cab149cf23909968f40ac2ee2cdd368f16c1c2.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
4e004cb79ab58c24f48a68f1b9cab149cf23909968f40ac2ee2cdd368f16c1c2.exe
Resource
win10v2004-20240412-en
General
-
Target
4e004cb79ab58c24f48a68f1b9cab149cf23909968f40ac2ee2cdd368f16c1c2.exe
-
Size
58KB
-
MD5
7ae9b9e84a37052f966b25f59217948e
-
SHA1
350ead044887301358c8750876205aae2403cce0
-
SHA256
4e004cb79ab58c24f48a68f1b9cab149cf23909968f40ac2ee2cdd368f16c1c2
-
SHA512
873a9d40c2d77c37e964b8e5d4e4c914e0fb0baf1f3d2178ca6d933dacbcb1ca7cd38e7e9b560bb61bbe0de6f1e5afc08ece3123e8e94663904a597a2e5aa6ce
-
SSDEEP
1536:u71oupKBmSGg8vmemBg5mdVzvPzsMF/xl:uBvpGeatx/3
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2784 wrote to memory of 2928 2784 4e004cb79ab58c24f48a68f1b9cab149cf23909968f40ac2ee2cdd368f16c1c2.exe 28 PID 2784 wrote to memory of 2928 2784 4e004cb79ab58c24f48a68f1b9cab149cf23909968f40ac2ee2cdd368f16c1c2.exe 28 PID 2784 wrote to memory of 2928 2784 4e004cb79ab58c24f48a68f1b9cab149cf23909968f40ac2ee2cdd368f16c1c2.exe 28 PID 2784 wrote to memory of 2928 2784 4e004cb79ab58c24f48a68f1b9cab149cf23909968f40ac2ee2cdd368f16c1c2.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e004cb79ab58c24f48a68f1b9cab149cf23909968f40ac2ee2cdd368f16c1c2.exe"C:\Users\Admin\AppData\Local\Temp\4e004cb79ab58c24f48a68f1b9cab149cf23909968f40ac2ee2cdd368f16c1c2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\4e004cb79ab58c24f48a68f1b9cab149cf23909968f40ac2ee2cdd368f16c1c2.exe"C:\Users\Admin\AppData\Local\Temp\4e004cb79ab58c24f48a68f1b9cab149cf23909968f40ac2ee2cdd368f16c1c2.exe" end2⤵PID:2928
-