Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 14:59
Behavioral task
behavioral1
Sample
70ware.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
70ware.exe
Resource
win10v2004-20240709-en
General
-
Target
70ware.exe
-
Size
7.8MB
-
MD5
b2094b618ce3c2ba52bcebaf4a8598c7
-
SHA1
e7bf5e0c347d264a43175b169fd2f117b4c50228
-
SHA256
8d1c64ccae01fc4d12c03b0f209c8be04d42a5eadc7c16b357fd6449e56e2e00
-
SHA512
ca1e2e38f2a08df6be24c6b79f58ffddf522202537945a0eb01fe3228b778c1d3156333f68e5b49b8e860d755a5507b72936fdc25f5babb70d259a11ac671a20
-
SSDEEP
196608:bt0+WBeNTfm/pf+xk4dlX/O2dRGtrbWOjgWyb:rWCy/pWu4DNdRGtrbvMWyb
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
Processes:
70ware.exepid process 2932 70ware.exe 2932 70ware.exe 2932 70ware.exe 2932 70ware.exe 2932 70ware.exe 2932 70ware.exe 2932 70ware.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI29482\python311.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
70ware.exedescription pid process target process PID 2948 wrote to memory of 2932 2948 70ware.exe 70ware.exe PID 2948 wrote to memory of 2932 2948 70ware.exe 70ware.exe PID 2948 wrote to memory of 2932 2948 70ware.exe 70ware.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI29482\api-ms-win-core-file-l1-2-0.dllFilesize
22KB
MD5852904535068e569e2b157f3bca0c08f
SHA1c79b4d109178f4ab8c19ab549286eee4edf6eddb
SHA256202b77cd363fce7c09d9a59b5779f701767c8734cc17bbe8b9ece5a0619f2225
SHA5123e814678c7aa0d3d3a637ce3048e3b472dbb01b2e2a5932e5b257aa76bf8de8117a38e2a352daff66939a73c1b971b302f5635ea1d826b8a3afa49f9b543a541
-
C:\Users\Admin\AppData\Local\Temp\_MEI29482\api-ms-win-core-file-l2-1-0.dllFilesize
22KB
MD5cdfc83e189bda0ac9eab447671754e87
SHA1cf597ee626366738d0ea1a1d8be245f26abbea72
SHA256f4811f251c49c9ae75f9fe25890bacede852e4f1bfdc6685f49096253a43f007
SHA512659ee46e210fcad6c778988a164ce3f69a137d05fb2699ff662540cbb281b38719017f1049d5189fafdae06c07a48d3d29dd98e11c1cae5d47768c243af37fe9
-
C:\Users\Admin\AppData\Local\Temp\_MEI29482\api-ms-win-core-localization-l1-2-0.dllFilesize
22KB
MD5f1d0595773886d101e684e772118d1ef
SHA1290276053a75cbeb794441965284b18311ab355d
SHA256040e1572da9a980392184b1315f27ebcdaf07a0d94ddf49cbd0d499f7cdb099a
SHA512db57f4ae78f7062cfe392d6829c5975be91d0062ff06725c45c06a74e04ade8bcaf709cfebeba8146fb4396206141aa49572968ea240aa1cba909e43985dc3ee
-
C:\Users\Admin\AppData\Local\Temp\_MEI29482\api-ms-win-core-processthreads-l1-1-1.dllFilesize
22KB
MD5e26a5e364a76bf00feaab920c535adbb
SHA1411eaf1ca1d8f1aebcd816d93933561c927f2754
SHA256b3c0356f64e583c8aca3b1284c6133540a8a12f94b74568fb78ddc36eac6ab15
SHA512333e42eeea07a46db46f222e27429facaaf2ce8a433f0c39f5d5c72e67d894c813d3cf77880434f6373e0d8fffa3ef96d5f37e38dd4775491f3da2b569e9df59
-
C:\Users\Admin\AppData\Local\Temp\_MEI29482\api-ms-win-core-timezone-l1-1-0.dllFilesize
22KB
MD5566232dabd645dcd37961d7ec8fde687
SHA188a7a8c777709ae4b6d47bed6678d0192eb3bc3f
SHA2561290d332718c47961052ebc97a3a71db2c746a55c035a32b72e5ff00eb422f96
SHA512e5d549c461859445006a4083763ce855adbb72cf9a0bcb8958daa99e20b1ca8a82dec12e1062787e2ae8aee94224b0c92171a4d99ed348b94eab921ede205220
-
C:\Users\Admin\AppData\Local\Temp\_MEI29482\python311.dllFilesize
1.6MB
MD5bb46b85029b543b70276ad8e4c238799
SHA1123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c
SHA25672c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0
SHA5125e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31
-
C:\Users\Admin\AppData\Local\Temp\_MEI29482\ucrtbase.dllFilesize
1.1MB
MD5a9f5b06fae677c9eb5be8b37d5fb1cb9
SHA15c37b880a1479445dd583f85c58a8790584f595d
SHA2564e9e93fd6486571e1b5dce381fa536fb6c5593584d3330368ccd47ee6107bf52
SHA5125d7664716fa52f407d56771862262317ac7f4a03f31f209333c3eea7f1c8cf3d5dbafc1942122948d19208d023df220407014f47e57694e70480a878822b779a
-
memory/2932-75-0x000007FEF5740000-0x000007FEF5D28000-memory.dmpFilesize
5.9MB