2abddeca8d33e2277353ed3d23053479bceb2961482badd1ea30bf4c059f04d7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 20:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2abddeca8d33e2277353ed3d23053479bceb2961482badd1ea30bf4c059f04d7.exe
Size

136KB
MD5

106df04e1fde251ca2ab9907ca08a04d
SHA1

931e47cc90b3387e33e338460f1b3b563d286115
SHA256

2abddeca8d33e2277353ed3d23053479bceb2961482badd1ea30bf4c059f04d7
SHA512

093965876b2650541cbf2e321a6e27414e6b2fa187f77b86098994c4d0a1bd56d9a7817f8e62c9696ff62b229a20c2bace194eff5ad83238012113019c3f5714
SSDEEP

1536:rty/CYMzUY76N/8TwFDgZzQrfz5a7LeAyNZ57yViFsLzUPhG:sRCtTwFDKzQrL5a3eAHViGJ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1844	Un_A.exe

Loads dropped DLL 1 IoCs

pid	Process
2244	2abddeca8d33e2277353ed3d23053479bceb2961482badd1ea30bf4c059f04d7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1844	Un_A.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1844	2244	2abddeca8d33e2277353ed3d23053479bceb2961482badd1ea30bf4c059f04d7.exe	28
PID 2244 wrote to memory of 1844	2244	2abddeca8d33e2277353ed3d23053479bceb2961482badd1ea30bf4c059f04d7.exe	28
PID 2244 wrote to memory of 1844	2244	2abddeca8d33e2277353ed3d23053479bceb2961482badd1ea30bf4c059f04d7.exe	28
PID 2244 wrote to memory of 1844	2244	2abddeca8d33e2277353ed3d23053479bceb2961482badd1ea30bf4c059f04d7.exe	28

C:\Users\Admin\AppData\Local\Temp\2abddeca8d33e2277353ed3d23053479bceb2961482badd1ea30bf4c059f04d7.exe
"C:\Users\Admin\AppData\Local\Temp\2abddeca8d33e2277353ed3d23053479bceb2961482badd1ea30bf4c059f04d7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
136KB

MD5
106df04e1fde251ca2ab9907ca08a04d

SHA1
931e47cc90b3387e33e338460f1b3b563d286115

SHA256
2abddeca8d33e2277353ed3d23053479bceb2961482badd1ea30bf4c059f04d7

SHA512
093965876b2650541cbf2e321a6e27414e6b2fa187f77b86098994c4d0a1bd56d9a7817f8e62c9696ff62b229a20c2bace194eff5ad83238012113019c3f5714

Download Submit