21749695d87fae1d1adc8162c22b14be674aeb8096f8538d3e169c1d951706ec

Analysis

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mem trojan version 2.exe
Size

3.6MB
MD5

defe0d7ab04de07169e817c2dead2bd7
SHA1

45d76da71d7ab01efbb620476e595a198139e276
SHA256

e9702f328464adaa2d7daf2be39bfa6a50b7f06cc536008438fa721779607e8d
SHA512

0ac579ba7d2f852f867a10ff861acd554adcf072fcdf00525e8ddc804d99d1d9b513739244092fa4e591fc4928353d81e39b0f604a9f90aca9c59dcfb61d2691
SSDEEP

98304:GEn4nJGCgbfnYb/Z6mRV6sSQVwvTPlFc6ZPB:GEn4sTYbsYfSAwr9PB

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2896	2276	mem trojan version 2.exe	28
PID 2276 wrote to memory of 2896	2276	mem trojan version 2.exe	28
PID 2276 wrote to memory of 2896	2276	mem trojan version 2.exe	28

C:\Users\Admin\AppData\Local\Temp\mem trojan version 2.exe
"C:\Users\Admin\AppData\Local\Temp\mem trojan version 2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mem2_safe\VBS.vbs"
  2⤵
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\mem2_safe\VBS.vbs

Filesize
934B

MD5
4ab8127d474a0ee5002ca428fcb73b53

SHA1
4073f0bccb8e79f37d8d33654758f91ea91e9ee1

SHA256
43353ffc450566c321b6c0608273a36990d83c533db4db7aa595d1c3aae4e03b

SHA512
55aa5950d50cad863e1c0c2fb849e399cba664529b0845a4a4641a3ff5e029875e5b9a467fafe94c7dd5a14983d929b4af62db439b1fbf3b0fa6f3ac6810e3ea

Download Submit