1d10713238e6d48ee5b8e78207c73d9cb1149012d33101f32478793db23862a8

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1d10713238e6d48ee5b8e78207c73d9cb1149012d33101f32478793db23862a8.exe
Size

544KB
MD5

4b9ba132c7cb1877797cb86eec4dc49c
SHA1

cd5854ed6232038efd1c40d04254ee3933a65842
SHA256

1d10713238e6d48ee5b8e78207c73d9cb1149012d33101f32478793db23862a8
SHA512

15383e4c216ef5a4e49e915da4368ca5e90e2cfeb618e2d8cb0a9a9fdb4f4190a383a90d28bcc2d84cb16414322952bcf5ddda02d2b07f19d555da25e37e9ee5
SSDEEP

12288:aQl/9wJbmh3DVCQM1+1cGyb+IG9cwzkZPHsg1P8Mf+TeKm:aQl/CJbmRY1MRyb+IGHzkFHT1PJfe5m

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2040	1d10713238e6d48ee5b8e78207c73d9cb1149012d33101f32478793db23862a8.exe
2040	1d10713238e6d48ee5b8e78207c73d9cb1149012d33101f32478793db23862a8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1632	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1632	2040	1d10713238e6d48ee5b8e78207c73d9cb1149012d33101f32478793db23862a8.exe	28
PID 2040 wrote to memory of 1632	2040	1d10713238e6d48ee5b8e78207c73d9cb1149012d33101f32478793db23862a8.exe	28
PID 2040 wrote to memory of 1632	2040	1d10713238e6d48ee5b8e78207c73d9cb1149012d33101f32478793db23862a8.exe	28
PID 2040 wrote to memory of 1632	2040	1d10713238e6d48ee5b8e78207c73d9cb1149012d33101f32478793db23862a8.exe	28

C:\Users\Admin\AppData\Local\Temp\1d10713238e6d48ee5b8e78207c73d9cb1149012d33101f32478793db23862a8.exe
"C:\Users\Admin\AppData\Local\Temp\1d10713238e6d48ee5b8e78207c73d9cb1149012d33101f32478793db23862a8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 528
  2⤵
  - Program crash
  PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd3E6C.tmp

Filesize
5B

MD5
e2fecc970546c3418917879fe354826c

SHA1
63f1c1dd01b87704a6b6c99fd9f141e0a3064f16

SHA256
ff91566d755f5d038ae698a2cc0a7d4d14e5273afafc37b6f03afda163768fa0

SHA512
3c4a68cbaee94f986515f43305a0e7620c14c30213d4a17db4a3e8a1b996764eb688bf733f472fc52073c2c80bb5229bb29411d7601aefe1c4370e230c341a0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd3E6C.tmp

Filesize
26B

MD5
17425c43be7fbedcbfb1934f0dc3e914

SHA1
8217a08d1c7fdbf5499aa5297e476cf38c12b8a6

SHA256
2e731782503bbf3b2fa333ff6e2da7c873dfeb1d11a25c5e7a013c11fb7028a1

SHA512
3a8a521c6c0fd50b15fb086a3bbc9d03b048c06350cc2812f214fcc73720c5f6d931fce0889ed4f36d8f3fb1402ebe2f23167b206e18d969296658d28971aed2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso3DBF.tmp

Filesize
17B

MD5
aa56823a4614597aa5035bfb3f63c847

SHA1
873c3e649bf0b41d9b4d1ee998df6e47abd32841

SHA256
7d544ae2f97f0655acb9017ff329202409d17e86552e93c27c08ae532cb57f98

SHA512
0a9c4cac8181cdd5638c9bcd1898370c1b51bef5094eaa886e06937e6e36986f31a54b14a0d044c64ef4b332dc5d785dfdaf5ac5e1c067eb4421fd87f2486472

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst3D8E.tmp

Filesize
74B

MD5
16d513397f3c1f8334e8f3e4fc49828f

SHA1
4ee15afca81ca6a13af4e38240099b730d6931f0

SHA256
d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36

SHA512
4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst3E2D.tmp

Filesize
14B

MD5
588cf7cdaab7fececa39c175c806ac8a

SHA1
c05dd1da9fe6f60c6480d5a7fe568bd231efcc01

SHA256
8ffa16681c60f9e5ae447896f50bebc45c5d27cb31e6ca97eaf3def44a2701f7

SHA512
7264057bad861cbfbf4aeb62c211b726c94540247e5a2282057ef2e583c4b6f1bc1c441217f68c6d280c7f4990ceaab6cd7fc34758375b3d89e3eae25d75e567

Download Submit
\Users\Admin\AppData\Local\Temp\nst3D8F.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
memory/2040-567-0x0000000004F30000-0x0000000006FA9000-memory.dmp

Filesize
32.5MB

Download
memory/2040-568-0x0000000004F30000-0x0000000006FA9000-memory.dmp

Filesize
32.5MB

Download