8aad772bebdd8b6f415ba2e7038b43a7a536952f8ba2284e321fbda20d01f3ab

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 03:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c7aff1eabc1f9c02ed6ec69d3460427f05a3619a8c191de4df28a9414774946.exe
Size

500KB
MD5

dfa0e8fd2a349c526938b2602947e457
SHA1

4cdc4939fc3feb328a5ad54d4d917e35ccdc9cdf
SHA256

6c7aff1eabc1f9c02ed6ec69d3460427f05a3619a8c191de4df28a9414774946
SHA512

1e09be5b5375246c91004d80fc6bce7ee66256208ccaca3a7776a43a9fa84de644624aebeddc020a43b67846e615d279c9d7e36d06601c1d915d9ea32f5dcf73
SSDEEP

12288:4+Oa75wxpzAZu9r46A9jmP/uhu/yMS08CkntxYR:FR75t1fmP/UDMS08Ckn3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

6c7aff1eabc1f9c02ed6ec69d3460427f05a3619a8c191de4df28a9414774946.exe

pid	process
2032	6c7aff1eabc1f9c02ed6ec69d3460427f05a3619a8c191de4df28a9414774946.exe
2032	6c7aff1eabc1f9c02ed6ec69d3460427f05a3619a8c191de4df28a9414774946.exe
2032	6c7aff1eabc1f9c02ed6ec69d3460427f05a3619a8c191de4df28a9414774946.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6c7aff1eabc1f9c02ed6ec69d3460427f05a3619a8c191de4df28a9414774946.exe

description	pid	process	target process
PID 2032 wrote to memory of 2184	2032	6c7aff1eabc1f9c02ed6ec69d3460427f05a3619a8c191de4df28a9414774946.exe	cmd.exe
PID 2032 wrote to memory of 2184	2032	6c7aff1eabc1f9c02ed6ec69d3460427f05a3619a8c191de4df28a9414774946.exe	cmd.exe
PID 2032 wrote to memory of 2184	2032	6c7aff1eabc1f9c02ed6ec69d3460427f05a3619a8c191de4df28a9414774946.exe	cmd.exe
PID 2032 wrote to memory of 2184	2032	6c7aff1eabc1f9c02ed6ec69d3460427f05a3619a8c191de4df28a9414774946.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\6c7aff1eabc1f9c02ed6ec69d3460427f05a3619a8c191de4df28a9414774946.exe
"C:\Users\Admin\AppData\Local\Temp\6c7aff1eabc1f9c02ed6ec69d3460427f05a3619a8c191de4df28a9414774946.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
2⤵
PID:2184

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads