45a32a4a46e916adfb5017ef80f07b7410f04879cd75193fedce951ba1751ced

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17-07-2024 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

maple/loader.exe
Size

5.3MB
MD5

e630d72436e3dc1be7763de7f75b7adf
SHA1

40e07b22ab8b69e6827f90e20aeac35757899a23
SHA256

59818142f41895d3cadf7bee0124b392af3473060f00b9548daa3a224223993e
SHA512

82f0be15e2736447fae7d9a313a8a81a2c6e6ca617539ff8bf3fa0d2fe93d96e68afea6964e96e9dd671ba4090ddbc8a759c9b68f10e24a7fb847fe2c9825a83
SSDEEP

98304:MY5XZjNqBeNp4iSgPKpQ9CKhqkaIWvO9SYCxBKXyaxVdb+tSVGHyYDMMl7qg7:MYpMeNp4irCmWISnTz2VtIVDMg7n7

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2600	loader.exe

Loads dropped DLL 2 IoCs

pid	Process
2696	loader.exe
2600	loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1736	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1736	7zFM.exe
Token: 35	1736	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1736	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2600	2696	loader.exe	32
PID 2696 wrote to memory of 2600	2696	loader.exe	32
PID 2696 wrote to memory of 2600	2696	loader.exe	32

C:\Users\Admin\AppData\Local\Temp\maple\loader.exe
"C:\Users\Admin\AppData\Local\Temp\maple\loader.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\onefile_2696_133656647046598000\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\maple\loader.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2600

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_2696_133656647046598000\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_2696_133656647046598000\loader.exe

Filesize
8.5MB

MD5
7e528c7d750373f489ed3983d28a5279

SHA1
805d666d7c3f98b0f2f21f8ded1ebc801bb87028

SHA256
7b025b56f3cec113e0569dfa37fa593f64d15c42116d321452500c03df105b8e

SHA512
40b4809678c6b17fcd389038464d32752058e60ed446d941698fee561641e740652bd305e2a6fe80cdd6171807fe6fbc22b99e4eaccd4c699acaca39b7328ca3

Download Submit