Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 12:38
Static task
static1
Behavioral task
behavioral1
Sample
384465693b395ccef3f37edd427649e0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
384465693b395ccef3f37edd427649e0N.exe
Resource
win10v2004-20240704-en
General
-
Target
384465693b395ccef3f37edd427649e0N.exe
-
Size
32KB
-
MD5
384465693b395ccef3f37edd427649e0
-
SHA1
21a2319369725fc3eca589f5a2073b6636abbeff
-
SHA256
fc2900f2dbc66cd7e8fbe7a70f427b108f9cd2b48dbb03058e8ce6a5f5c4103a
-
SHA512
f3e64c0ff8fe47f986dafc97b9151c51ba011fb29bc1b84eadc742f8b210ca76b9073f102d3222e1a15d6cc48056b8b7aa26ee4149b74d668a9fb130e1fff40b
-
SSDEEP
768:OtkSEpBYWOqpRz+Oza7hYUtXz8z7nIV9dr2V9r7Dk9J:6kBpvTz+B7xYY/KV9Q9J
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\CD0378C2 = "C:\\Users\\Admin\\AppData\\Roaming\\CD0378C2\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exepid process 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe 1952 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 1952 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
384465693b395ccef3f37edd427649e0N.exewinver.exedescription pid process target process PID 2120 wrote to memory of 1952 2120 384465693b395ccef3f37edd427649e0N.exe winver.exe PID 2120 wrote to memory of 1952 2120 384465693b395ccef3f37edd427649e0N.exe winver.exe PID 2120 wrote to memory of 1952 2120 384465693b395ccef3f37edd427649e0N.exe winver.exe PID 2120 wrote to memory of 1952 2120 384465693b395ccef3f37edd427649e0N.exe winver.exe PID 2120 wrote to memory of 1952 2120 384465693b395ccef3f37edd427649e0N.exe winver.exe PID 1952 wrote to memory of 1204 1952 winver.exe Explorer.EXE PID 1952 wrote to memory of 1120 1952 winver.exe taskhost.exe PID 1952 wrote to memory of 1176 1952 winver.exe Dwm.exe PID 1952 wrote to memory of 1204 1952 winver.exe Explorer.EXE PID 1952 wrote to memory of 1572 1952 winver.exe DllHost.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\384465693b395ccef3f37edd427649e0N.exe"C:\Users\Admin\AppData\Local\Temp\384465693b395ccef3f37edd427649e0N.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1120-27-0x0000000077371000-0x0000000077372000-memory.dmpFilesize
4KB
-
memory/1120-26-0x0000000002090000-0x0000000002096000-memory.dmpFilesize
24KB
-
memory/1176-20-0x0000000001F80000-0x0000000001F86000-memory.dmpFilesize
24KB
-
memory/1176-30-0x0000000001F80000-0x0000000001F86000-memory.dmpFilesize
24KB
-
memory/1204-10-0x0000000077371000-0x0000000077372000-memory.dmpFilesize
4KB
-
memory/1204-22-0x0000000002D50000-0x0000000002D56000-memory.dmpFilesize
24KB
-
memory/1204-31-0x0000000002D50000-0x0000000002D56000-memory.dmpFilesize
24KB
-
memory/1204-4-0x0000000002DA0000-0x0000000002DA6000-memory.dmpFilesize
24KB
-
memory/1204-3-0x0000000002DA0000-0x0000000002DA6000-memory.dmpFilesize
24KB
-
memory/1204-2-0x0000000002DA0000-0x0000000002DA6000-memory.dmpFilesize
24KB
-
memory/1572-28-0x0000000000340000-0x0000000000346000-memory.dmpFilesize
24KB
-
memory/1572-29-0x0000000077371000-0x0000000077372000-memory.dmpFilesize
4KB
-
memory/1572-25-0x0000000000340000-0x0000000000346000-memory.dmpFilesize
24KB
-
memory/1952-6-0x0000000000130000-0x0000000000136000-memory.dmpFilesize
24KB
-
memory/1952-9-0x000000007751F000-0x0000000077521000-memory.dmpFilesize
8KB
-
memory/1952-7-0x0000000077520000-0x0000000077521000-memory.dmpFilesize
4KB
-
memory/1952-11-0x0000000077320000-0x00000000774C9000-memory.dmpFilesize
1.7MB
-
memory/1952-8-0x000000007751F000-0x0000000077520000-memory.dmpFilesize
4KB
-
memory/1952-36-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/1952-37-0x0000000000130000-0x0000000000136000-memory.dmpFilesize
24KB
-
memory/2120-13-0x0000000001D60000-0x0000000002760000-memory.dmpFilesize
10.0MB
-
memory/2120-1-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/2120-12-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2120-5-0x0000000001D60000-0x0000000002760000-memory.dmpFilesize
10.0MB
-
memory/2120-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB