Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 18:38
Behavioral task
behavioral1
Sample
c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe
Resource
win10v2004-20240508-en
General
-
Target
c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe
-
Size
2.3MB
-
MD5
fc294c2db2de7c6270db5ea3f70125eb
-
SHA1
71ebf4c50c9b253d6829ed4544a835fa50c0d83f
-
SHA256
c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a
-
SHA512
8598f744ffc0389809fef8f153fae8ec0b0dd08d9aa0f0ab5ac00d21b7e4cbbaef8d31a26225f37ab0c3a2b549cbd3e3d1f9b9b2c8dc41e67521b4945e700eb6
-
SSDEEP
49152:RkWk5cS7a+9XYaQ+Zehc4mTYJ78V9gyBn4cX1fmP/SA8N:9ajJBZ942KQV9hp4gfmP/SA8
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exepid process 1844 c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe 1844 c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe 1844 c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exedescription pid process target process PID 1844 wrote to memory of 2752 1844 c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe cmd.exe PID 1844 wrote to memory of 2752 1844 c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe cmd.exe PID 1844 wrote to memory of 2752 1844 c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe cmd.exe PID 1844 wrote to memory of 2752 1844 c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe"C:\Users\Admin\AppData\Local\Temp\c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\2⤵