Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    06/06/2024, 20:36

General

  • Target

    2b8620bb5c22ce747db82ad31287ee5c9db897d83fa9be75db6ea2e746b537ba.exe

  • Size

    86KB

  • MD5

    a175c6b86c4abf8b97557daef940cb0d

  • SHA1

    7110f8120225288a152ec9078541fb40434056fd

  • SHA256

    2b8620bb5c22ce747db82ad31287ee5c9db897d83fa9be75db6ea2e746b537ba

  • SHA512

    bcddd4d7f0984ae354e89097a3015058fb5952365e1026214bcf4bfc511f8917300230baaa3ce262b6af6d25259215dcb37eb7068832c646b05990f85aa850c9

  • SSDEEP

    768:ZZKM11gG4ChfiPO0rfz0shcUypMC5/VKhZyg3Xf:eMDgG4ChfiPOefgsOUqQwg

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 14 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b8620bb5c22ce747db82ad31287ee5c9db897d83fa9be75db6ea2e746b537ba.exe
    "C:\Users\Admin\AppData\Local\Temp\2b8620bb5c22ce747db82ad31287ee5c9db897d83fa9be75db6ea2e746b537ba.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 92
      2⤵
      • Program crash
      PID:2760

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\system\Sysexp32.exe

          Filesize

          98KB

          MD5

          0301adddc1061e328bd8925d0bf79900

          SHA1

          f87e342a6d5df4a6968b5b751548d7e6de5762b7

          SHA256

          0614cf528a59024bba7a6d5bd678c948a8e9637a93ef54119d07624db510c244

          SHA512

          ec4176d0688fcb559025b6c7fe6a90503d3613f9f27807405f3549974f57cabbcaa4e04d0feefe48cf22676620464cc0563616fe7485371f3ee5b8bb56517e52