5e921611411a1f372b02c4655a25f021c666b897e6e4f0ff59ef8a8877792c1f

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MSK203.exe
Size

495KB
MD5

672127d627b0d1ffdc8f4f6a7f6a4697
SHA1

965c08f135e270201ca61122955104c0de39ad9f
SHA256

c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42
SHA512

f3e6c7837c767944d7e14cac75e5844fa217cfdc3d6dcae575a7d0ad2740617cce9e53e6b28f947114708361570972150737c9c1e3663b5b3ee9fd55a2d6a746
SSDEEP

12288:Pbm37Owct5ERd1ZRad1I5eA2bZxeyCNNrmj:Pbms5EP1CAsZxse

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

MSK203.exe

pid process

2276 MSK203.exe
2276 MSK203.exe
Drops file in Windows directory 1 IoCs

Processes:

MSK203.exe

description ioc process

File opened for modification C:\Windows\Fonts\Apoplektikerens\Chateaubriand.Exi MSK203.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1300 2276 WerFault.exe MSK203.exe

pid	process
2276	MSK203.exe
2276	MSK203.exe

description	ioc	process
File opened for modification	C:\Windows\Fonts\Apoplektikerens\Chateaubriand.Exi	MSK203.exe

pid	pid_target	process	target process
1300	2276	WerFault.exe	MSK203.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

MSK203.exe

description	pid	process	target process
PID 2276 wrote to memory of 1300	2276	MSK203.exe	WerFault.exe
PID 2276 wrote to memory of 1300	2276	MSK203.exe	WerFault.exe
PID 2276 wrote to memory of 1300	2276	MSK203.exe	WerFault.exe
PID 2276 wrote to memory of 1300	2276	MSK203.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\MSK203.exe
"C:\Users\Admin\AppData\Local\Temp\MSK203.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 528
2⤵
- Program crash
PID:1300

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd1A78.tmp
Filesize
37B

MD5
a77b52747594c1935369ba6407f3ea1f

SHA1
c3dea5e72d2904237d62933a6287d4471bb40876

SHA256
f58ea262eba17880c381068e18e07ef1ba3f39d5de330b74e47fa924e9f58d94

SHA512
573f5ce763322d0282f2eaf6106d8dda1c3750f601c9b39ba9f14010d6cf14594cc06480703cbe2658b2366d30d6f9634ee8b89598f33f599f68329449da43d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd1A78.tmp
Filesize
56B

MD5
2c77bbd52333e4144ba070082eac42d6

SHA1
d5570ca72f198bd75e1f0d241f0dd69986877ea4

SHA256
54695e5022b16a8b57b4995eabb2d2b2212e0f3fc6ddad15cb2bbc5798fa3c04

SHA512
c800b128aee9e19cfa614be129deed3a440263ff5b58d801e4929ceebf5a930eba8efe948c70e163294a4dabe993a6dcc24f3ca3cef859877da852919dce4162

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd1AC7.tmp
Filesize
13B

MD5
f6dd1b23c7a68545a2c2dbf678cf8683

SHA1
43eeed66236b1b5868671abdc138051daa64fd16

SHA256
38e0646749072dd0bfa54e9cc2884b454d7ea22b08d816599d86f7f162e1c7e8

SHA512
a23ad3fc2ca9259a0641bc445eb71848c5e824694f844dea4d35d985aa65fa6a882af3d4f873042df9da564e0ec4afd0ad2bc6911c00a70f9e82171d53fb76d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso1A19.tmp
Filesize
4B

MD5
cde63b34c142af0a38cbe83791c964f8

SHA1
ece2b194b486118b40ad12c1f0e9425dd0672424

SHA256
65e2d70166c9a802b7ad2a87129b8945f083e5f268878790a9d1f1c03f47938d

SHA512
0559d3d34ad64ccc27e685431c24fc6ead0f645db14fa0e125a64fb67dbd158c15432c1fc5407811aac8a3486090dfbcfcbc3c6bf5aa0ec73f979ef62d14853c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy19B9.tmp
Filesize
74B

MD5
16d513397f3c1f8334e8f3e4fc49828f

SHA1
4ee15afca81ca6a13af4e38240099b730d6931f0

SHA256
d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36

SHA512
4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy1A58.tmp
Filesize
60B

MD5
6905490802a6c440fab7bc3299682016

SHA1
7212e3db4f3387c8ff2daee9a94067db11a218be

SHA256
0fc3d8084bd0470747f5e0ecb10127bbf64b1b7618ab5a819db38e4b839d3451

SHA512
fcf7b1927605f76bd61d0f5c467b040f210d37ae99477f1a1984cc84037c2b7b461c668e1ba993dcb4e9393c2c7a16ac2b42ba2e97d4e18121ba18d800a04a1d

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1A08.tmp\System.dll
Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit