Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    03/07/2024, 02:40

General

  • Target

    79e0739e57ca58d4c114b2bd4d0352bc.exe

  • Size

    391KB

  • MD5

    79e0739e57ca58d4c114b2bd4d0352bc

  • SHA1

    4b28548ea4b13a962823db02a9b2739aaf67be1e

  • SHA256

    f8bf909bc16676ce59de2eae2206b53b7203e6bfe20c5edee98ba8188f36c25b

  • SHA512

    496552299d846eb6e066a9555929630e8b32b3ff804c73b010d3c71e09f9775fa8735b815bb65642aeb372e62adb052fff4e6428a99eaf6761e1df0d3ca0a27e

  • SSDEEP

    6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXu:nnOflT/ZFIjBz3xjTxynGUOUhXu

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79e0739e57ca58d4c114b2bd4d0352bc.exe
    "C:\Users\Admin\AppData\Local\Temp\79e0739e57ca58d4c114b2bd4d0352bc.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:2448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    392KB

    MD5

    d0af7a99e49a678b26825eb5be7ca045

    SHA1

    3d926f50b8b0bbf1bcaaf14f8e9da3ce50d65aaa

    SHA256

    ab0c48cc29d926eb3f527dda04dfb43b5ebdf52cc437f64f346dbc9382fc9b41

    SHA512

    a56122588ad3922d35c2cb9c9b2ff32d49854393cf7caae75a1ad760e755a45ab12ff5445ddfa0a402be3c82b2f594ef9f6c6d997c31bd7d71d377cf54278503

  • memory/2176-8-0x0000000000390000-0x0000000000396000-memory.dmp

    Filesize

    24KB

  • memory/2176-1-0x00000000003A0000-0x00000000003A6000-memory.dmp

    Filesize

    24KB

  • memory/2176-0-0x0000000000390000-0x0000000000396000-memory.dmp

    Filesize

    24KB

  • memory/2448-15-0x0000000000310000-0x0000000000316000-memory.dmp

    Filesize

    24KB