Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 23:34
Static task
static1
Behavioral task
behavioral1
Sample
7a2d5f53e59f04a34b317459201d55c853bc81884448da06f030a8bff0feb421.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7a2d5f53e59f04a34b317459201d55c853bc81884448da06f030a8bff0feb421.exe
Resource
win10v2004-20240508-en
General
-
Target
7a2d5f53e59f04a34b317459201d55c853bc81884448da06f030a8bff0feb421.exe
-
Size
225KB
-
MD5
b1c3cf250437991bc52e7046251dc7bc
-
SHA1
6321a7b20ab661ca6e2ad766d78db41919ea0fa7
-
SHA256
7a2d5f53e59f04a34b317459201d55c853bc81884448da06f030a8bff0feb421
-
SHA512
abac0e590ba1bac3ce9531c30aaf3a8552e33fffa462d05e754c01949d4290aa51be0248c3069b451f1e752e8486c7b3cfc37622da06271e0dd430dcb9a11ada
-
SSDEEP
6144:BA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:BATuTAnKGwUAW3ycQqgf
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\96797A2A = "C:\\Users\\Admin\\AppData\\Roaming\\96797A2A\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 61 IoCs
Processes:
winver.exepid process 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe 2536 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 2536 winver.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
7a2d5f53e59f04a34b317459201d55c853bc81884448da06f030a8bff0feb421.exewinver.exedescription pid process target process PID 2880 wrote to memory of 2536 2880 7a2d5f53e59f04a34b317459201d55c853bc81884448da06f030a8bff0feb421.exe winver.exe PID 2880 wrote to memory of 2536 2880 7a2d5f53e59f04a34b317459201d55c853bc81884448da06f030a8bff0feb421.exe winver.exe PID 2880 wrote to memory of 2536 2880 7a2d5f53e59f04a34b317459201d55c853bc81884448da06f030a8bff0feb421.exe winver.exe PID 2880 wrote to memory of 2536 2880 7a2d5f53e59f04a34b317459201d55c853bc81884448da06f030a8bff0feb421.exe winver.exe PID 2880 wrote to memory of 2536 2880 7a2d5f53e59f04a34b317459201d55c853bc81884448da06f030a8bff0feb421.exe winver.exe PID 2536 wrote to memory of 1204 2536 winver.exe Explorer.EXE PID 2536 wrote to memory of 1112 2536 winver.exe taskhost.exe PID 2536 wrote to memory of 1176 2536 winver.exe Dwm.exe PID 2536 wrote to memory of 1204 2536 winver.exe Explorer.EXE
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\7a2d5f53e59f04a34b317459201d55c853bc81884448da06f030a8bff0feb421.exe"C:\Users\Admin\AppData\Local\Temp\7a2d5f53e59f04a34b317459201d55c853bc81884448da06f030a8bff0feb421.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1112-21-0x0000000001F50000-0x0000000001F56000-memory.dmpFilesize
24KB
-
memory/1112-11-0x0000000001F50000-0x0000000001F56000-memory.dmpFilesize
24KB
-
memory/1176-14-0x00000000001C0000-0x00000000001C6000-memory.dmpFilesize
24KB
-
memory/1176-23-0x00000000001C0000-0x00000000001C6000-memory.dmpFilesize
24KB
-
memory/1204-17-0x0000000003120000-0x0000000003126000-memory.dmpFilesize
24KB
-
memory/1204-3-0x0000000002A80000-0x0000000002A86000-memory.dmpFilesize
24KB
-
memory/1204-6-0x0000000002A80000-0x0000000002A86000-memory.dmpFilesize
24KB
-
memory/1204-1-0x0000000002A80000-0x0000000002A86000-memory.dmpFilesize
24KB
-
memory/1204-22-0x0000000003120000-0x0000000003126000-memory.dmpFilesize
24KB
-
memory/2536-20-0x00000000003D0000-0x00000000003D6000-memory.dmpFilesize
24KB
-
memory/2536-4-0x0000000000170000-0x0000000000176000-memory.dmpFilesize
24KB
-
memory/2536-25-0x00000000003D0000-0x00000000003D6000-memory.dmpFilesize
24KB
-
memory/2880-8-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB