Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    15-08-2024 00:46

General

  • Target

    blocker.exe

  • Size

    5.6MB

  • MD5

    872b0fa8c0306040f181d08c5d7a252b

  • SHA1

    a08cf74361c96aa4d7e4503af6563c63b95f1973

  • SHA256

    3a5576c4e7d9ed56cc295fea24ef0fa68cf4235dfefa434caa32015887e757c3

  • SHA512

    23d8610ac8bfcb68695b652dd8d35edcc5f17994c90966ef0cabf11489d983cc852dd8e6d36ec85c78ec6f63cb6a7b21238a6d9687494f3ef99bc7ca86a4a277

  • SSDEEP

    98304:GRx4heu/+/tswG+PJPigEtVTH41ZE6HqM/aZeOO4wZivrH/LXmfI1ZWQpy:GL4gy+/tbG+PJa3txT6KKaLbwZivrjdJ

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\blocker.exe
    "C:\Users\Admin\AppData\Local\Temp\blocker.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\blocker.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1868
      • C:\Windows\system32\certutil.exe
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\blocker.exe" MD5
        3⤵
          PID:2536
        • C:\Windows\system32\find.exe
          find /i /v "md5"
          3⤵
            PID:2380
          • C:\Windows\system32\find.exe
            find /i /v "certutil"
            3⤵
              PID:2152
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c CLS
            2⤵
              PID:2716

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2304-4-0x0000000076E70000-0x0000000076E72000-memory.dmp

            Filesize

            8KB

          • memory/2304-2-0x0000000076E70000-0x0000000076E72000-memory.dmp

            Filesize

            8KB

          • memory/2304-0-0x0000000076E70000-0x0000000076E72000-memory.dmp

            Filesize

            8KB

          • memory/2304-5-0x000000013F520000-0x000000013FEED000-memory.dmp

            Filesize

            9.8MB

          • memory/2304-9-0x000000013F5B8000-0x000000013F955000-memory.dmp

            Filesize

            3.6MB

          • memory/2304-10-0x000000013F520000-0x000000013FEED000-memory.dmp

            Filesize

            9.8MB

          • memory/2304-11-0x000000013F520000-0x000000013FEED000-memory.dmp

            Filesize

            9.8MB