579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe
Size

13.0MB
MD5

4b55cb09a7aaa655bff315854cc1d491
SHA1

26db65eb6b0d6a7ed70fc129f249f2bc18b3ab27
SHA256

579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb
SHA512

c7baf1ce5dcc7ca6dbe80db336f092e2805223db62e7008ad31943aaed63b6e71e1371202d6ed048a8f78b41398367747a0ed2683a22e270967b1e3237f739e8
SSDEEP

393216:sb0zsM3W+TQbcVCuTTEVUiWT1u8F7WDoVeSnk:sb0zPswIxUziDovk

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2336	DataStoreCacheDumpTool&t.exe
2364	DataStoreCacheDumpTool&t.exe

Loads dropped DLL 9 IoCs

pid	Process
2016	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe
2016	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2336	DataStoreCacheDumpTool&t.exe
2364	DataStoreCacheDumpTool&t.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2336	2016	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	30
PID 2016 wrote to memory of 2336	2016	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	30
PID 2016 wrote to memory of 2336	2016	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	30
PID 2016 wrote to memory of 2548	2016	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	31
PID 2016 wrote to memory of 2548	2016	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	31
PID 2016 wrote to memory of 2548	2016	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	31
PID 2016 wrote to memory of 2364	2016	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	32
PID 2016 wrote to memory of 2364	2016	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	32
PID 2016 wrote to memory of 2364	2016	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	32
PID 2336 wrote to memory of 2604	2336	DataStoreCacheDumpTool&t.exe	34
PID 2336 wrote to memory of 2604	2336	DataStoreCacheDumpTool&t.exe	34
PID 2336 wrote to memory of 2604	2336	DataStoreCacheDumpTool&t.exe	34

C:\Users\Admin\AppData\Local\Temp\579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe
"C:\Users\Admin\AppData\Local\Temp\579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\DataStoreCacheDumpTool&t.exe
  "C:\Users\Admin\AppData\Local\Temp\DataStoreCacheDumpTool&t.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2336 -s 356
    3⤵
    - Loads dropped DLL
    PID:2604
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FIash-setup.VBS"
  2⤵
  PID:2548
- C:\Users\Admin\AppData\Local\Temp\DataStoreCacheDumpTool&t.exe
  "C:\Users\Admin\AppData\Local\Temp\DataStoreCacheDumpTool&t.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FIash-setup.VBS

Filesize
66B

MD5
3475bd06427e0bb1557816db74e90dd8

SHA1
213c05319f7291ca527b8f0b8670917d1d4c6b65

SHA256
3e45bf737861c65af59db82ad70c13c795c5309a134fdac0717cae5ad69eacf0

SHA512
54af790db479bc55fb23f46bd4584cce04c8b5e6ae397fffd8a4d958e951ebf8ac2535b8ab3189da6c6d3c2efe11c84d78d26a9b7ec0469be1647074d024e922

Download Submit
\Users\Admin\AppData\Local\Temp\DataStoreCacheDumpTool&t.exe

Filesize
273KB

MD5
f9ab2f60d7acd5d8bd9866697c95f4c6

SHA1
e7fe2624965504ca6f531fe189e1f070ac59e24a

SHA256
57e07e068392053f9e00b28dad2127e381c7c51fa593faecc2ebc3a05a5b01b0

SHA512
a256b92339e2a774e05a6ecbe62d3d78879fbc2a4f0b26a5a3f07fc031c0578a9adc351f0a245a74479ffd197efd6873373376fbe624dfba876236d8cf663808

Download Submit
memory/2336-17-0x0000000002150000-0x0000000002152000-memory.dmp

Filesize
8KB

Download