Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 22:17
Static task
static1
Behavioral task
behavioral1
Sample
671c8a69512c3790649863fae0599ccaf8b0f9a3d2bc2bfc0855939e54a12d59.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
671c8a69512c3790649863fae0599ccaf8b0f9a3d2bc2bfc0855939e54a12d59.exe
Resource
win10v2004-20240611-en
General
-
Target
671c8a69512c3790649863fae0599ccaf8b0f9a3d2bc2bfc0855939e54a12d59.exe
-
Size
225KB
-
MD5
7b557319669ab874cdf3d36361de5b3a
-
SHA1
9085c8379151a99cc23e74cbc15cea315f1185fd
-
SHA256
671c8a69512c3790649863fae0599ccaf8b0f9a3d2bc2bfc0855939e54a12d59
-
SHA512
d0339febeca8d78ae901aa9cdb193960af8313c78dda7bcc46e5fa78ad2f2070545a2009ab5d4298f2980532faa0d5f074ef3d13383e505b41063002044a4356
-
SSDEEP
6144:SA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:SATuTAnKGwUAW3ycQqgf
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\142CCF91 = "C:\\Users\\Admin\\AppData\\Roaming\\142CCF91\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 61 IoCs
Processes:
winver.exepid process 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe 2272 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 2272 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
671c8a69512c3790649863fae0599ccaf8b0f9a3d2bc2bfc0855939e54a12d59.exewinver.exedescription pid process target process PID 2436 wrote to memory of 2272 2436 671c8a69512c3790649863fae0599ccaf8b0f9a3d2bc2bfc0855939e54a12d59.exe winver.exe PID 2436 wrote to memory of 2272 2436 671c8a69512c3790649863fae0599ccaf8b0f9a3d2bc2bfc0855939e54a12d59.exe winver.exe PID 2436 wrote to memory of 2272 2436 671c8a69512c3790649863fae0599ccaf8b0f9a3d2bc2bfc0855939e54a12d59.exe winver.exe PID 2436 wrote to memory of 2272 2436 671c8a69512c3790649863fae0599ccaf8b0f9a3d2bc2bfc0855939e54a12d59.exe winver.exe PID 2436 wrote to memory of 2272 2436 671c8a69512c3790649863fae0599ccaf8b0f9a3d2bc2bfc0855939e54a12d59.exe winver.exe PID 2272 wrote to memory of 1188 2272 winver.exe Explorer.EXE PID 2272 wrote to memory of 1100 2272 winver.exe taskhost.exe PID 2272 wrote to memory of 1160 2272 winver.exe Dwm.exe PID 2272 wrote to memory of 1188 2272 winver.exe Explorer.EXE PID 2272 wrote to memory of 2436 2272 winver.exe 671c8a69512c3790649863fae0599ccaf8b0f9a3d2bc2bfc0855939e54a12d59.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1100
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\671c8a69512c3790649863fae0599ccaf8b0f9a3d2bc2bfc0855939e54a12d59.exe"C:\Users\Admin\AppData\Local\Temp\671c8a69512c3790649863fae0599ccaf8b0f9a3d2bc2bfc0855939e54a12d59.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2272
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1100-9-0x0000000002070000-0x0000000002076000-memory.dmpFilesize
24KB
-
memory/1100-23-0x0000000002070000-0x0000000002076000-memory.dmpFilesize
24KB
-
memory/1160-25-0x0000000000130000-0x0000000000136000-memory.dmpFilesize
24KB
-
memory/1160-12-0x0000000000130000-0x0000000000136000-memory.dmpFilesize
24KB
-
memory/1188-15-0x0000000002AF0000-0x0000000002AF6000-memory.dmpFilesize
24KB
-
memory/1188-3-0x0000000002AE0000-0x0000000002AE6000-memory.dmpFilesize
24KB
-
memory/1188-6-0x0000000002AE0000-0x0000000002AE6000-memory.dmpFilesize
24KB
-
memory/1188-24-0x0000000002AF0000-0x0000000002AF6000-memory.dmpFilesize
24KB
-
memory/1188-1-0x0000000002AE0000-0x0000000002AE6000-memory.dmpFilesize
24KB
-
memory/2272-20-0x0000000000290000-0x0000000000296000-memory.dmpFilesize
24KB
-
memory/2272-4-0x0000000000160000-0x0000000000166000-memory.dmpFilesize
24KB
-
memory/2272-27-0x0000000000290000-0x0000000000296000-memory.dmpFilesize
24KB
-
memory/2436-22-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB