95e217da4c184170c705e9ef317b5d8333713f4f91435d0964e0e2cea03100ab

Analysis

max time kernel
124s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 14:00

Target

90f19e1a7843dbee63856899da664d073c2b8fadd0cad368e623d5f7426ba5ef.exe
Size

9.0MB
MD5

ae5ffe6a64aef13c2712f073032b0806
SHA1

6285497d8786742cca307bcf6958ecb01f439f42
SHA256

90f19e1a7843dbee63856899da664d073c2b8fadd0cad368e623d5f7426ba5ef
SHA512

81573d0c93538750d89daef81de1370441c48927620e2569ff038917d968b5760e9db68733a4f82d679c7832781c75cace285d6047e5947a5120f9a87ec14590
SSDEEP

196608:gAeiSGnXc86iAD/0LUcEhNLbdubxaUTE8pUcXc1uVzb9:gn8nXc8WD/0LS6LVvzp

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

90f19e1a7843dbee63856899da664d073c2b8fadd0cad368e623d5f7426ba5ef.exe

pid process

2268 90f19e1a7843dbee63856899da664d073c2b8fadd0cad368e623d5f7426ba5ef.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exe

pid process

1748 ipconfig.exe

pid	process
2268	90f19e1a7843dbee63856899da664d073c2b8fadd0cad368e623d5f7426ba5ef.exe

pid	process
1748	ipconfig.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

90f19e1a7843dbee63856899da664d073c2b8fadd0cad368e623d5f7426ba5ef.exe

description	pid	process	target process
PID 2268 wrote to memory of 1844	2268	90f19e1a7843dbee63856899da664d073c2b8fadd0cad368e623d5f7426ba5ef.exe	netsh.exe
PID 2268 wrote to memory of 1844	2268	90f19e1a7843dbee63856899da664d073c2b8fadd0cad368e623d5f7426ba5ef.exe	netsh.exe
PID 2268 wrote to memory of 1844	2268	90f19e1a7843dbee63856899da664d073c2b8fadd0cad368e623d5f7426ba5ef.exe	netsh.exe
PID 2268 wrote to memory of 1844	2268	90f19e1a7843dbee63856899da664d073c2b8fadd0cad368e623d5f7426ba5ef.exe	netsh.exe
PID 2268 wrote to memory of 1748	2268	90f19e1a7843dbee63856899da664d073c2b8fadd0cad368e623d5f7426ba5ef.exe	ipconfig.exe
PID 2268 wrote to memory of 1748	2268	90f19e1a7843dbee63856899da664d073c2b8fadd0cad368e623d5f7426ba5ef.exe	ipconfig.exe
PID 2268 wrote to memory of 1748	2268	90f19e1a7843dbee63856899da664d073c2b8fadd0cad368e623d5f7426ba5ef.exe	ipconfig.exe
PID 2268 wrote to memory of 1748	2268	90f19e1a7843dbee63856899da664d073c2b8fadd0cad368e623d5f7426ba5ef.exe	ipconfig.exe

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
2⤵
- Gathers network information
PID:1748

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

\WuYouIP\update.exe
Filesize
4.6MB

MD5
e9a963c7a995921b78d2657d33524029

SHA1
c3fa95d9f9f1dc71e151baf54f15dfb4b822cf55

SHA256
99f12909c76a4f818169859a0a3b9e5f77ef6b75aefe8402f25cb90a54f09f64

SHA512
27aca412300606ec1b938ec444c1ed8514a0d78fe6c1e2d101033f40268571ea78dff2ae1f5c1830b55b50cde239334be49c0cc3683744ad4d68e1d4ef08db3b

Download Submit
memory/2268-0-0x0000000000E60000-0x0000000000EA0000-memory.dmp

Filesize
256KB

Download
memory/2268-1-0x0000000000E60000-0x0000000000EA0000-memory.dmp

Filesize
256KB

Download