Analysis
-
max time kernel
20s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 20:15
Static task
static1
Behavioral task
behavioral1
Sample
2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe
Resource
win10v2004-20240508-en
General
-
Target
2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe
-
Size
505KB
-
MD5
f0727af461a35fd5bd823f0fa44ddc11
-
SHA1
ba17b0dec3d2be9dc97f14e3e24db3472b8687c1
-
SHA256
2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4
-
SHA512
0c5c56de868d499efd0f06f5689fd916a19c27256dc137a5acdae3e7049a3089080c3f9b610dbaf8f22fbee449b479f2b1fcd464b12524053cd19f8c310ff0b9
-
SSDEEP
12288:wlb9+b1gL5pRTcAkS/3hzN8qE43fm78VG:Wb9+G5jcAkSYqyEG
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 7 IoCs
resource yara_rule behavioral1/memory/1904-0-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/files/0x000c00000001226d-15.dat UPX behavioral1/memory/2236-16-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/1904-12-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2548-29-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2668-26-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2236-30-0x0000000000400000-0x000000000041B000-memory.dmp UPX -
Executes dropped EXE 4 IoCs
pid Process 2548 MSWDM.EXE 2236 MSWDM.EXE 2716 2E84B1ECFB37D8E358E78DD0EB58757DA48974C8769A6F2FB378DBF52A732AB4.EXE 2668 MSWDM.EXE -
Loads dropped DLL 2 IoCs
pid Process 2548 MSWDM.EXE 2696 Process not Found -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" 2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" 2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" MSWDM.EXE -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\MSWDM.EXE 2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe File opened for modification C:\Windows\dev1CF3.tmp 2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2548 MSWDM.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1904 wrote to memory of 2236 1904 2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe 28 PID 1904 wrote to memory of 2236 1904 2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe 28 PID 1904 wrote to memory of 2236 1904 2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe 28 PID 1904 wrote to memory of 2236 1904 2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe 28 PID 1904 wrote to memory of 2548 1904 2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe 29 PID 1904 wrote to memory of 2548 1904 2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe 29 PID 1904 wrote to memory of 2548 1904 2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe 29 PID 1904 wrote to memory of 2548 1904 2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe 29 PID 2548 wrote to memory of 2716 2548 MSWDM.EXE 30 PID 2548 wrote to memory of 2716 2548 MSWDM.EXE 30 PID 2548 wrote to memory of 2716 2548 MSWDM.EXE 30 PID 2548 wrote to memory of 2716 2548 MSWDM.EXE 30 PID 2548 wrote to memory of 2668 2548 MSWDM.EXE 32 PID 2548 wrote to memory of 2668 2548 MSWDM.EXE 32 PID 2548 wrote to memory of 2668 2548 MSWDM.EXE 32 PID 2548 wrote to memory of 2668 2548 MSWDM.EXE 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe"C:\Users\Admin\AppData\Local\Temp\2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\WINDOWS\MSWDM.EXE"C:\WINDOWS\MSWDM.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2236
-
-
C:\WINDOWS\MSWDM.EXE-r!C:\Windows\dev1CF3.tmp!C:\Users\Admin\AppData\Local\Temp\2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe! !2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\2E84B1ECFB37D8E358E78DD0EB58757DA48974C8769A6F2FB378DBF52A732AB4.EXE
- Executes dropped EXE
PID:2716
-
-
C:\WINDOWS\MSWDM.EXE-e!C:\Windows\dev1CF3.tmp!C:\Users\Admin\AppData\Local\Temp\2E84B1ECFB37D8E358E78DD0EB58757DA48974C8769A6F2FB378DBF52A732AB4.EXE!3⤵
- Executes dropped EXE
PID:2668
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD571590a394c11b44c310693ffb52ef953
SHA1bb72bcb66f1715b5bc4f8ee381b019429ca3f9bb
SHA2568fd59f8ab0f51e3fd7eba263687359adf15bdc907b77b06c67292710a8f4a583
SHA5124a2ad4c33eca0a1aeeb8d0f39be482f9bcad9405850ab2c76d027be9952a12ca8c8d7c052a9fd8dd6c0d276ace2caedaf30f428bdaf5c19aec5eef7bcbbbba41
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628