Analysis
-
max time kernel
110s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 03:04
Static task
static1
Behavioral task
behavioral1
Sample
4029ef5c22e407db8d5ff6c5f1286600N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4029ef5c22e407db8d5ff6c5f1286600N.exe
Resource
win10v2004-20240709-en
General
-
Target
4029ef5c22e407db8d5ff6c5f1286600N.exe
-
Size
716KB
-
MD5
4029ef5c22e407db8d5ff6c5f1286600
-
SHA1
8a39a6d1d817bcaff5e4fd84f9b6c2e1615387a6
-
SHA256
03e8ac968df7b058ac4c5e546dec7e2403071562a9033ba8da2c88d1ece45fac
-
SHA512
7225ea684c5d25f7c1661cdad7d9601280454bcde42eae87ee616f5f52e207b5bbc13351f8e4696e0148ce27cff83bfbfa48f1d02a635d8785b04ac6fb63687f
-
SSDEEP
12288:v2Ut4GIHGniMbq3VMDdybH1fsU4JTmVFiY5HxPScqKvnY3QyunoYcS5KT:v2U7IHGrq+DYZKOiax8YaXa6
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2696 4029ef5c22e407db8d5ff6c5f1286600N.tmp -
Loads dropped DLL 3 IoCs
pid Process 2252 4029ef5c22e407db8d5ff6c5f1286600N.exe 2696 4029ef5c22e407db8d5ff6c5f1286600N.tmp 2696 4029ef5c22e407db8d5ff6c5f1286600N.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2696 4029ef5c22e407db8d5ff6c5f1286600N.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2696 2252 4029ef5c22e407db8d5ff6c5f1286600N.exe 30 PID 2252 wrote to memory of 2696 2252 4029ef5c22e407db8d5ff6c5f1286600N.exe 30 PID 2252 wrote to memory of 2696 2252 4029ef5c22e407db8d5ff6c5f1286600N.exe 30 PID 2252 wrote to memory of 2696 2252 4029ef5c22e407db8d5ff6c5f1286600N.exe 30 PID 2252 wrote to memory of 2696 2252 4029ef5c22e407db8d5ff6c5f1286600N.exe 30 PID 2252 wrote to memory of 2696 2252 4029ef5c22e407db8d5ff6c5f1286600N.exe 30 PID 2252 wrote to memory of 2696 2252 4029ef5c22e407db8d5ff6c5f1286600N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4029ef5c22e407db8d5ff6c5f1286600N.exe"C:\Users\Admin\AppData\Local\Temp\4029ef5c22e407db8d5ff6c5f1286600N.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\is-NSV05.tmp\4029ef5c22e407db8d5ff6c5f1286600N.tmp"C:\Users\Admin\AppData\Local\Temp\is-NSV05.tmp\4029ef5c22e407db8d5ff6c5f1286600N.tmp" /SL5="$4010A,497037,53248,C:\Users\Admin\AppData\Local\Temp\4029ef5c22e407db8d5ff6c5f1286600N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
669KB
MD552950ac9e2b481453082f096120e355a
SHA1159c09db1abcee9114b4f792ffba255c78a6e6c3
SHA25625fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd
SHA5125b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba