abf118e584b79b827445ad79f1e4ba1dadb8237b338f4bae1f09c69e48d0b3eb

Analysis

max time kernel
82s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23092_01.exe
Size

2.3MB
MD5

b1076dea3c398326478bb0d03c266086
SHA1

ed45e82e58fd4c2764a5dd7c8f845311f6485826
SHA256

abf118e584b79b827445ad79f1e4ba1dadb8237b338f4bae1f09c69e48d0b3eb
SHA512

efa1647813b926e1dc0c4d12899cbb223774966b9336df1055f7db416e94e4e8b64227716ce98c2649f229ccc4ab28d77ee9840b089f74bc108f471bdee89442
SSDEEP

49152:ZjZGyv5iQPJ3wM9CFHADGdGMnD3Pk7fx1mX7UcfXMV4raxc:/G6iQPFZwFADGdGMDY1wxXMV1xc

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2072	23092_01.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 2072	4576	23092_01.exe	91
PID 4576 wrote to memory of 2072	4576	23092_01.exe	91
PID 4576 wrote to memory of 2072	4576	23092_01.exe	91

C:\Users\Admin\AppData\Local\Temp\23092_01.exe
"C:\Users\Admin\AppData\Local\Temp\23092_01.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Users\Admin\AppData\Local\Temp\is-58I1U.tmp\23092_01.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-58I1U.tmp\23092_01.tmp" /SL5="$802C4,1981680,140800,C:\Users\Admin\AppData\Local\Temp\23092_01.exe"
  2⤵
  - Executes dropped EXE
  PID:2072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3916,i,7761714625659357865,10802238739796857379,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
1⤵
PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-58I1U.tmp\23092_01.tmp

Filesize
1.1MB

MD5
a4cb46c715d6e7b72755eab92123a3ea

SHA1
1e769da1816daae7d50c8812c59ee20399431a2d

SHA256
686699d59606cd7d2253dff2c92003380361f00b168305e959e66bab9bc725c0

SHA512
8bdce037441eb0ed6aa5fdf7569580b32dd5294b6b4a36a054552e5b46fcbba328b659f2277d3a75d23d9ead64a28d3db2fe49c0b1c13e6d799490ce6509ab1b

Download Submit
memory/2072-7-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2072-14-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/4576-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4576-2-0x0000000000401000-0x0000000000417000-memory.dmp

Filesize
88KB

Download
memory/4576-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download