Analysis

  • max time kernel
    20s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    30/05/2024, 20:15

General

  • Target

    2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe

  • Size

    505KB

  • MD5

    f0727af461a35fd5bd823f0fa44ddc11

  • SHA1

    ba17b0dec3d2be9dc97f14e3e24db3472b8687c1

  • SHA256

    2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4

  • SHA512

    0c5c56de868d499efd0f06f5689fd916a19c27256dc137a5acdae3e7049a3089080c3f9b610dbaf8f22fbee449b479f2b1fcd464b12524053cd19f8c310ff0b9

  • SSDEEP

    12288:wlb9+b1gL5pRTcAkS/3hzN8qE43fm78VG:Wb9+G5jcAkSYqyEG

Score
9/10

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 7 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe
    "C:\Users\Admin\AppData\Local\Temp\2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1904
    • C:\WINDOWS\MSWDM.EXE
      "C:\WINDOWS\MSWDM.EXE"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2236
    • C:\WINDOWS\MSWDM.EXE
      -r!C:\Windows\dev1CF3.tmp!C:\Users\Admin\AppData\Local\Temp\2e84b1ecfb37d8e358e78dd0eb58757da48974c8769a6f2fb378dbf52a732ab4.exe! !
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2548
      • C:\Users\Admin\AppData\Local\Temp\2E84B1ECFB37D8E358E78DD0EB58757DA48974C8769A6F2FB378DBF52A732AB4.EXE
        3⤵
        • Executes dropped EXE
        PID:2716
      • C:\WINDOWS\MSWDM.EXE
        -e!C:\Windows\dev1CF3.tmp!C:\Users\Admin\AppData\Local\Temp\2E84B1ECFB37D8E358E78DD0EB58757DA48974C8769A6F2FB378DBF52A732AB4.EXE!
        3⤵
        • Executes dropped EXE
        PID:2668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\WINDOWS\MSWDM.EXE

    Filesize

    47KB

    MD5

    71590a394c11b44c310693ffb52ef953

    SHA1

    bb72bcb66f1715b5bc4f8ee381b019429ca3f9bb

    SHA256

    8fd59f8ab0f51e3fd7eba263687359adf15bdc907b77b06c67292710a8f4a583

    SHA512

    4a2ad4c33eca0a1aeeb8d0f39be482f9bcad9405850ab2c76d027be9952a12ca8c8d7c052a9fd8dd6c0d276ace2caedaf30f428bdaf5c19aec5eef7bcbbbba41

  • C:\Windows\dev1CF3.tmp

    Filesize

    458KB

    MD5

    619f7135621b50fd1900ff24aade1524

    SHA1

    6c7ea8bbd435163ae3945cbef30ef6b9872a4591

    SHA256

    344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

    SHA512

    2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

  • memory/1904-0-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1904-12-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2236-16-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2236-30-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2548-29-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2548-23-0x00000000002D0000-0x00000000002EB000-memory.dmp

    Filesize

    108KB

  • memory/2668-26-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB