7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exe
Size

495KB
MD5

a5358ad15678d24fe88bb1fe32d29ae3
SHA1

86f0639010c601118aeea1767d48d865f4b6bb8e
SHA256

7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e
SHA512

ce06f31ab63a46b1fa9f57b213f034222a7f53a1e97a8cb24bec6c2829264a3bf368a9c86d2650ddc6bc1c5a74229c2dcb0c4239360f60cc2bca18ece290f5a5
SSDEEP

12288:NyAfDcgcTQhgpZBDtoRAG01LqTl2mZoikM:vDVBADt1ZKlXEM

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

EXEFA56.tmp

pid process

804 EXEFA56.tmp

pid	process
804	EXEFA56.tmp

Loads dropped DLL 2 IoCs

Processes:

7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exe

pid	process
2264	7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exe
2264	7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

EXEFA56.tmp

pid process

804 EXEFA56.tmp
804 EXEFA56.tmp

pid	process
804	EXEFA56.tmp
804	EXEFA56.tmp

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exeEXEFA56.tmp

description	pid	process	target process
PID 2264 wrote to memory of 804	2264	7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exe	EXEFA56.tmp
PID 2264 wrote to memory of 804	2264	7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exe	EXEFA56.tmp
PID 2264 wrote to memory of 804	2264	7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exe	EXEFA56.tmp
PID 2264 wrote to memory of 804	2264	7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exe	EXEFA56.tmp
PID 804 wrote to memory of 2196	804	EXEFA56.tmp	splwow64.exe
PID 804 wrote to memory of 2196	804	EXEFA56.tmp	splwow64.exe
PID 804 wrote to memory of 2196	804	EXEFA56.tmp	splwow64.exe
PID 804 wrote to memory of 2196	804	EXEFA56.tmp	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exe
"C:\Users\Admin\AppData\Local\Temp\7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264

C:\Users\Admin\AppData\Local\Temp\EXEFA56.tmp
"C:\Users\Admin\AppData\Local\Temp\EXEFA56.tmp" "C:\Users\Admin\AppData\Local\Temp\OFMFA57.tmp" "C:\Users\Admin\AppData\Local\Temp\7d3ff41401c78239e784e4c11ef0c74d66a4e40afcb8dcbec2fc2284ae2a469e.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:804

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:2196

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OFMFA57.tmp
Filesize
48KB

MD5
f3f70f725ad7b80a417ca119b8ba7bed

SHA1
0e887b51b3bdbbf400b14da9255d416ca4ba80fc

SHA256
97bd8c349d25e6856b56550abad3ff3b11ec2f9384dfc1dd8a1d1f3e500d6af2

SHA512
a24758e8e7a8e7aabfce0f63e55bd10bd6af405fce08159d18c9f656f4079bdf246accd64ef25e407b90d3428323bdb85f40c3ba4ad664521fd659d719428412

Download Submit
\Users\Admin\AppData\Local\Temp\EXEFA56.tmp
Filesize
968KB

MD5
0f619e7352920d8d21926f2b715e0794

SHA1
cdd75d72647b1c75477c069b51b5f8ab5dc63e50

SHA256
e6090962c2504441c1cd5f6ee75dd5ffbddc38062f02807f0d44176d8f464381

SHA512
380592a1382f40d80839efea429619470b09fc0c0aad8666c6392d8dbd112f5e8719538fc93044454f4ce67375aaae8da59e09563b167ff8adf34240be684dae

Download Submit