6a376fe44ef36163cd1122115de56b53257515f8cee61ac80d808e41cb5b58c5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.W32.PossibleThreat.15054.10599.exe
Size

1.5MB
MD5

b6665390cce41606cb845ba11c2b24b3
SHA1

b56e581a321d0b7102c9ea1b83486e9ab7f7e5cd
SHA256

6a376fe44ef36163cd1122115de56b53257515f8cee61ac80d808e41cb5b58c5
SHA512

ce1a6070ce10de7ccbd167897d4d19766c8db96adde38f6cbbd6c9b5ef4db9c7c94c89cf0239547f9a70f12d04158b9417a152c4c28d07288ae84b6dc7a0c229
SSDEEP

24576:5OtT5xvEeiNboeFyZuY588lZJxip12/V01imQxlqbyDPr3eDj+g9dEnNeTi/v1iZ:5OtT/i1YxlAXMV0sJ70ywENeTCiQ0dd

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1256	aConvTabV2m1.EXE

Loads dropped DLL 4 IoCs

pid	Process
2412	SecuriteInfo.com.W32.PossibleThreat.15054.10599.exe
2412	SecuriteInfo.com.W32.PossibleThreat.15054.10599.exe
2412	SecuriteInfo.com.W32.PossibleThreat.15054.10599.exe
2412	SecuriteInfo.com.W32.PossibleThreat.15054.10599.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1256	2412	SecuriteInfo.com.W32.PossibleThreat.15054.10599.exe	28
PID 2412 wrote to memory of 1256	2412	SecuriteInfo.com.W32.PossibleThreat.15054.10599.exe	28
PID 2412 wrote to memory of 1256	2412	SecuriteInfo.com.W32.PossibleThreat.15054.10599.exe	28
PID 2412 wrote to memory of 1256	2412	SecuriteInfo.com.W32.PossibleThreat.15054.10599.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.PossibleThreat.15054.10599.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.PossibleThreat.15054.10599.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Delta5\Formularios\F2217v03\Otros\aConvTabV2m1.EXE
  "C:\Delta5\Formularios\F2217v03\Otros\aConvTabV2m1.EXE"
  2⤵
  - Executes dropped EXE
  PID:1256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Delta5\Formularios\F2217v03\Otros\aConvTabV2m1.exe

Filesize
270KB

MD5
27e47bb149d4415dba28761428703403

SHA1
7387016cccb970d947a9c1da94280147d6fcda2f

SHA256
6f7f09f1588b05c2598eb86ab0a789a1137a9c069b3db59db377a4a8ee36fd63

SHA512
9032bd671690ae5ec552303c531c2b31b90eae64ac6b50414095b9f4502641633c558b30dc2c10c591fed906250e792b0d13f00681fa3b60f667805e6a51b7ef

Download Submit