de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d

Analysis

max time kernel
1557s
max time network
1558s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe
Size

794KB
MD5

4b0994f79c4f20c8a121d5a2b53caf84
SHA1

1f02d9751edea6a50fea3ed671fe6355ca0ba2d8
SHA256

de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d
SHA512

c6ace568997edae890635d71f53f71c006b27771ca04de8ed900f617eb34c96aa3d689d242787d1b486a4eb863b73d3d422bc94c4ce164637de7c026f958acf4
SSDEEP

12288:aH4q/W7id7BUm5rKfq3wAFFumGoDzAqrhYRP8XAMk8rH4qfvb:aHRe7i7UImkvjgR8A0rHRfvb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2900	de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe
2780	de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe
2372	de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2900	de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe
2900	de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe
2780	de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe
2780	de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe
2372	de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe
2372	de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2780	2900	de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe	29
PID 2900 wrote to memory of 2780	2900	de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe	29
PID 2900 wrote to memory of 2780	2900	de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe	29
PID 2900 wrote to memory of 2780	2900	de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe	29
PID 2780 wrote to memory of 2372	2780	de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe	30
PID 2780 wrote to memory of 2372	2780	de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe	30
PID 2780 wrote to memory of 2372	2780	de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe	30
PID 2780 wrote to memory of 2372	2780	de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe	30

C:\Users\Admin\AppData\Local\Temp\de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe
"C:\Users\Admin\AppData\Local\Temp\de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe
  "C:\Users\Admin\AppData\Local\Temp\de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe" /retrynav 1
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe
    "C:\Users\Admin\AppData\Local\Temp\de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe" /retrynav 2
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2372-14-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2780-7-0x0000000000030000-0x0000000000035000-memory.dmp

Filesize
20KB

Download
memory/2780-8-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2780-9-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2780-10-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download
memory/2780-12-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2900-0-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2900-1-0x0000000000030000-0x0000000000035000-memory.dmp

Filesize
20KB

Download
memory/2900-2-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2900-3-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2900-4-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/2900-6-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download