9faf9441a0935c717c9656a25b8c460840b2be5005293b6532157418275c3b0d

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
07-06-2024 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9faf9441a0935c717c9656a25b8c460840b2be5005293b6532157418275c3b0d.exe
Size

44KB
MD5

0a74e88d73f9cb9103479be5c142e2ee
SHA1

65e6ad75fa299bb2d14894ff3078774e9b44a962
SHA256

9faf9441a0935c717c9656a25b8c460840b2be5005293b6532157418275c3b0d
SHA512

9f3f357a6ed32e5e29e7abea3637dca6a539852f00c2396e326955e684c4003cfee351a6229a35701b6051a06ed03789bef37ef965ba0b80da68449cad1796d8
SSDEEP

768:uXWsAYF0UQj0TU9a+IWNu9B1MxlthhMLWI027zpiUGtuoJRnepUseAMIT5l1mh:umsAYBdTU9fEAIS2PEtulp7LQ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2096	Un_A.exe

Loads dropped DLL 2 IoCs

pid	Process
2436	9faf9441a0935c717c9656a25b8c460840b2be5005293b6532157418275c3b0d.exe
2096	Un_A.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ankiaddon\	Un_A.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.apkg	Un_A.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.apkg\	Un_A.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.colpkg	Un_A.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.colpkg\	Un_A.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ankiaddon	Un_A.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2096	2436	9faf9441a0935c717c9656a25b8c460840b2be5005293b6532157418275c3b0d.exe	28
PID 2436 wrote to memory of 2096	2436	9faf9441a0935c717c9656a25b8c460840b2be5005293b6532157418275c3b0d.exe	28
PID 2436 wrote to memory of 2096	2436	9faf9441a0935c717c9656a25b8c460840b2be5005293b6532157418275c3b0d.exe	28
PID 2436 wrote to memory of 2096	2436	9faf9441a0935c717c9656a25b8c460840b2be5005293b6532157418275c3b0d.exe	28

C:\Users\Admin\AppData\Local\Temp\9faf9441a0935c717c9656a25b8c460840b2be5005293b6532157418275c3b0d.exe
"C:\Users\Admin\AppData\Local\Temp\9faf9441a0935c717c9656a25b8c460840b2be5005293b6532157418275c3b0d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso2E82.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
44KB

MD5
0a74e88d73f9cb9103479be5c142e2ee

SHA1
65e6ad75fa299bb2d14894ff3078774e9b44a962

SHA256
9faf9441a0935c717c9656a25b8c460840b2be5005293b6532157418275c3b0d

SHA512
9f3f357a6ed32e5e29e7abea3637dca6a539852f00c2396e326955e684c4003cfee351a6229a35701b6051a06ed03789bef37ef965ba0b80da68449cad1796d8

Download Submit