8ff8af7b31fe7ed58b2afc1b556c635c2ccdf20bce7ca371897dea490a8b5027

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464.exe
Size

4.2MB
MD5

98d4a021d297fc479a7badbb378907a0
SHA1

ff8fa169a1727ad4529f0e9ab957bb3a3a119b40
SHA256

00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464
SHA512

df158667cdc3f78cebf48397dd0a48aa66d928b8e74e10d28e96be88cbceaad3604fd9e1ca9d7091407b267548d02d268a4c75af6315b53470a761808aad826b
SSDEEP

98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4uluP:ovsJR0TW6yiIKRhzqOsP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

IOJ9Y.exe

pid process

2960 IOJ9Y.exe
Executes dropped EXE 1 IoCs

Processes:

IOJ9Y.exe

pid process

2960 IOJ9Y.exe
Loads dropped DLL 2 IoCs

Processes:

00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464.exeIOJ9Y.exe

pid process

2324 00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464.exe
2960 IOJ9Y.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

IOJ9Y.exe

pid process

2960 IOJ9Y.exe
2960 IOJ9Y.exe
2960 IOJ9Y.exe
2960 IOJ9Y.exe
2960 IOJ9Y.exe
2960 IOJ9Y.exe

pid	process
2960	IOJ9Y.exe

pid	process
2960	IOJ9Y.exe

pid	process
2324	00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464.exe
2960	IOJ9Y.exe

pid	process
2960	IOJ9Y.exe
2960	IOJ9Y.exe
2960	IOJ9Y.exe
2960	IOJ9Y.exe
2960	IOJ9Y.exe
2960	IOJ9Y.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464.exeIOJ9Y.exe

description	pid	process
Token: SeDebugPrivilege	2324	00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464.exe
Token: 0	2324	00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464.exe
Token: SeDebugPrivilege	2960	IOJ9Y.exe
Token: 0	2960	IOJ9Y.exe
Token: SeShutdownPrivilege	2960	IOJ9Y.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464.exe

description	pid	process	target process
PID 2324 wrote to memory of 2960	2324	00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464.exe	IOJ9Y.exe
PID 2324 wrote to memory of 2960	2324	00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464.exe	IOJ9Y.exe
PID 2324 wrote to memory of 2960	2324	00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464.exe	IOJ9Y.exe

C:\Users\Admin\AppData\Local\Temp\00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464.exe
"C:\Users\Admin\AppData\Local\Temp\00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324

C:\Users\Admin\AppData\Local\Temp\IOJ9Y.exe
"C:\Users\Admin\AppData\Local\Temp\IOJ9Y.exe" -Continue|"C:\Users\Admin\AppData\Local\Temp\00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464.exe"
2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DIH\VAC.zip
Filesize
13KB

MD5
5a8e8dedf1d910c79defff5638978d07

SHA1
bfab518af8a53f02c4f98fc321aa0984a208686c

SHA256
d5bf8619a6f47e74aceb629da039f25493b0b8fb2f892bda2b32bd68c0cf8893

SHA512
7acfc4d0bde75a518f394319c8cd6743d36eb7ebcdcd26eeae2fb59ead70bb8b4d2fb29be93c89b529775f8a407a9bcd6e4d2a2955c03b15f2880ff9aa61a519

Download Submit
C:\Users\Admin\AppData\Local\Temp\IOJ9Y.exe
Filesize
4.2MB

MD5
372014eda479f1328d78dd7eba805c0a

SHA1
f0d1948625049c1a90b2d7309ee4e11bd6d22884

SHA256
7af2bd66ac250e3178b8a6bee42964660b9ec82a5eef603463d7f004d6b9d47d

SHA512
fa3c006895dbc34ff11cddea280bcbfe2a16372203bef54324c45dd586d71a1342d6562fa401bebc9e230d46eead6cf846a9c553a6408f02b7ead95617d49b6a

Download Submit
\Users\Admin\AppData\Local\Temp\ScintillaNET\3.6.3\x64\SciLexer.dll
Filesize
1.3MB

MD5
a70486cf41bf065ff8e76e8619745361

SHA1
e06e75380b17fec737fbdfeaa4a09b83e54d4838

SHA256
1563fc1966e779f0fcb71753f15e73ec770e169a0ad6e3c5af736764d9bd5858

SHA512
02f1c909fcbf7c0f5604ccb4e807640d80a2236c3cac6975e2e849bda318419e7188bb6a48184940eb381e2af375c83d7539e58951edf5e49ec11dd0cff66cc0

Download Submit
memory/2324-10-0x000007FEF5450000-0x000007FEF5E3C000-memory.dmp

Filesize
9.9MB

Download
memory/2324-2-0x000007FEF5450000-0x000007FEF5E3C000-memory.dmp

Filesize
9.9MB

Download
memory/2324-5-0x000000001C330000-0x000000001C484000-memory.dmp

Filesize
1.3MB

Download
memory/2324-6-0x000007FEF5450000-0x000007FEF5E3C000-memory.dmp

Filesize
9.9MB

Download
memory/2324-3-0x000000001B5E0000-0x000000001B6C0000-memory.dmp

Filesize
896KB

Download
memory/2324-0-0x000007FEF5453000-0x000007FEF5454000-memory.dmp

Filesize
4KB

Download
memory/2324-11-0x000007FEF5450000-0x000007FEF5E3C000-memory.dmp

Filesize
9.9MB

Download
memory/2324-4-0x00000000005C0000-0x0000000000602000-memory.dmp

Filesize
264KB

Download
memory/2324-25-0x000007FEF5450000-0x000007FEF5E3C000-memory.dmp

Filesize
9.9MB

Download
memory/2324-1-0x0000000001300000-0x0000000001736000-memory.dmp

Filesize
4.2MB

Download
memory/2960-24-0x0000000000C20000-0x0000000001056000-memory.dmp

Filesize
4.2MB

Download
memory/2960-27-0x000007FEF5450000-0x000007FEF5E3C000-memory.dmp

Filesize
9.9MB

Download
memory/2960-28-0x0000000000440000-0x0000000000482000-memory.dmp

Filesize
264KB

Download
memory/2960-26-0x000007FEF5450000-0x000007FEF5E3C000-memory.dmp

Filesize
9.9MB

Download
memory/2960-32-0x000007FEF5450000-0x000007FEF5E3C000-memory.dmp

Filesize
9.9MB

Download
memory/2960-33-0x000007FEF5450000-0x000007FEF5E3C000-memory.dmp

Filesize
9.9MB

Download