ffd9743164425fa3a80b49cec8d06f6d5f157a8cb9f23037e5908bb61f8c2f58

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

web_open.exe
Size

7.8MB
MD5

ff73798069aca5fa10e70c43993086b7
SHA1

58207bab17b05d5f2ad877197439c78e704286e5
SHA256

ffd9743164425fa3a80b49cec8d06f6d5f157a8cb9f23037e5908bb61f8c2f58
SHA512

bcdfbe3350e4aa634832ed68dcf861982b11be2102ece20725ad5c4ebecdd5d05735746a801cd530bd2e879b636d6a6e7fcbe2755d4117d53792acd6a9ea6148
SSDEEP

196608:Q7uS1W903eV4Q+tpDjIIAcwDNjRPJvvk9LIL:mW+eGQ69jodyk

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

Processes:

web_open.exe

pid process

2572 web_open.exe
2572 web_open.exe
2572 web_open.exe
2572 web_open.exe
2572 web_open.exe
2572 web_open.exe
2572 web_open.exe

pid	process
2572	web_open.exe
2572	web_open.exe
2572	web_open.exe
2572	web_open.exe
2572	web_open.exe
2572	web_open.exe
2572	web_open.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

web_open.exe

description	pid	process	target process
PID 2248 wrote to memory of 2572	2248	web_open.exe	web_open.exe
PID 2248 wrote to memory of 2572	2248	web_open.exe	web_open.exe
PID 2248 wrote to memory of 2572	2248	web_open.exe	web_open.exe

C:\Users\Admin\AppData\Local\Temp\web_open.exe
"C:\Users\Admin\AppData\Local\Temp\web_open.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2248

C:\Users\Admin\AppData\Local\Temp\web_open.exe
"C:\Users\Admin\AppData\Local\Temp\web_open.exe"
2⤵
- Loads dropped DLL
PID:2572

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI22482\api-ms-win-core-file-l1-2-0.dll
Filesize
22KB

MD5
ac4df73c97799aa9f5bec3c5fd78937e

SHA1
6a95f8f24b6faf92580be7d2b587eb43714937e8

SHA256
796896827a8eb53cfc40e49ffd56ce4c5e40671c94b8102f97dce67a351e997c

SHA512
4db9636f306bf851678d4ad12c7b33dfeaeecf65393ac9f843dc5cb7382532644475a653d708dbd1cb6bae4db1b5273e84ce76ee0941649cb02ebca9e7afb44a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22482\api-ms-win-core-file-l2-1-0.dll
Filesize
22KB

MD5
5bf0d34b49a16004c9b2297502c736da

SHA1
60d30cad05932086fafd87890b40ea798ff5143e

SHA256
94d0ea1ff3707665bbbe9942d000e497306504575bee4e687fa8a51a29b841e6

SHA512
9feaf1e7b602370edb67a2dfa627b09a96aa905b946ffe2af2d595288ed784d43d8e4bb1d29f23f459535b5892d38088dfd9a73fdf636dc21b6d9143f56e77a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22482\api-ms-win-core-localization-l1-2-0.dll
Filesize
22KB

MD5
21077a051ef0f7a06f11b2270920bb9b

SHA1
6d3ae3eabf83c8206ff3eea1c73ac02e1e649de4

SHA256
fb37e0ad35ca4446e9edafdf5c2ac55cae0b40f3a609f6fa63688d2f5bc90df4

SHA512
3bdded7681618d62e430e4ead2101b5e6cc39866eaeb1bb5330234006d86eb884f388cbd3a4e56dbcad02f9573a69f4d9164dbfb58d773fc92bb810b1bf0075f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22482\api-ms-win-core-processthreads-l1-1-1.dll
Filesize
22KB

MD5
d5cb714b845fbd16f4139412417653bf

SHA1
f3316169ae8909cb2dbf9769d7e253a09b4590d0

SHA256
eb299c380b9149f65ce7be6945a2a2eb0e63bfa87a27759e456b7050eb744cdb

SHA512
f6444115e5de000e13ed0cd13a4adf686974c78b48bd2cf8c1fea8e05f5f5494dae2e74b7706c7651ad4c0cfbeee108fb786878629650d1ed2b8f31d3881e4ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22482\api-ms-win-core-timezone-l1-1-0.dll
Filesize
22KB

MD5
7cf41ccd6d1f252d16475a116d9a8f1d

SHA1
3167fca636a5d3306a22924f4edb0aaff6eecbb4

SHA256
049c9a49353416701a0672985800734e515be2b5f5445fb5fb3813845460008e

SHA512
6f7ea04d7d25396e0bf776140cacc42a31e355453d158ca4d88b3b03d0662fe4c9d20b006bb17087375d3d8b87d9f9c70c9c7508e370883033f6cf6a552ad15e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22482\python312.dll
Filesize
6.6MB

MD5
5c5602cda7ab8418420f223366fff5db

SHA1
52f81ee0aef9b6906f7751fd2bbd4953e3f3b798

SHA256
e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce

SHA512
51c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22482\ucrtbase.dll
Filesize
1.1MB

MD5
b0ceb85c5e954f543abc076fa8de17f9

SHA1
0969b9819d72e24139d1f931c27710e814581d27

SHA256
1e316042bf54883cde951203633b087c2dcfdb2195af0526fb9d686541b14950

SHA512
36d9182a73edcd14949f93dfefd47f513fce5760efb8fa8a111af9001a0752f2dc90a92374aaafa9f58ff58f6603ee9e6efdd49ff5359fe6e69f2e1ef7a6cd73

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads