Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    09/07/2024, 14:56

General

  • Target

    server - strings.exe

  • Size

    497KB

  • MD5

    a0fe5bfe79fcd7d20144164ff45440af

  • SHA1

    7c0babb19b640b5a047879ce4463ca4871baa1aa

  • SHA256

    91d5376675fbe9fc845b71ea9ffd0fe886c3ecdb1fd8157f8d4dfba64e36064b

  • SHA512

    fcbf36433f07db2673f6f47c71653f20eb78a6269797adc021bc84f440e253f8bc010fdbaeca909fa19c751d4a826a90c1ad62cf76f31c68ccad0a953dd3684b

  • SSDEEP

    12288:+oqYCS3py+MLYTSrE8NrY+7G63XqDkwBWKsafOL2eX:+oqY7grgarY+dXqDN4KsafOL2eX

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\server - strings.exe
    "C:\Users\Admin\AppData\Local\Temp\server - strings.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    PID:1740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1740-3-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1740-4-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1740-5-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1740-6-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1740-7-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1740-8-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1740-9-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1740-10-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1740-11-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1740-12-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1740-13-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1740-14-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1740-15-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1740-16-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB