Analysis

  • max time kernel
    14s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    01/09/2024, 09:47

General

  • Target

    $EXEFILE.exe

  • Size

    241KB

  • MD5

    769858b9a9534fc44facc07a274913b7

  • SHA1

    acdfca23cf3cab7415cd4d678fce8628203e9a7a

  • SHA256

    06d8ecd88f5699aee559724003203566510b19c77d45c4c450c2bc50aa945622

  • SHA512

    47e19fe8a35665391241b8296c179495030c75934a7e5fc98a63f487a28964d9a244f90a7ce7693800018f6451b378f95ac110879f7b4de72db0581eee6f2829

  • SSDEEP

    3072:sfgMQJ7OFExkU0UJiwM6EWBqcjDQtoQ/pfMmI7ObPhV7q:OxQZOF0kU0FwFZjDQtv86bPh

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$EXEFILE.exe
    "C:\Users\Admin\AppData\Local\Temp\$EXEFILE.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    PID:2164

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2164-0-0x000007FEF620E000-0x000007FEF620F000-memory.dmp

    Filesize

    4KB

  • memory/2164-1-0x0000000000750000-0x000000000075C000-memory.dmp

    Filesize

    48KB

  • memory/2164-2-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

    Filesize

    9.6MB

  • memory/2164-3-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

    Filesize

    9.6MB

  • memory/2164-4-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

    Filesize

    9.6MB

  • memory/2164-5-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

    Filesize

    9.6MB

  • memory/2164-6-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

    Filesize

    9.6MB

  • memory/2164-7-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

    Filesize

    9.6MB

  • memory/2164-8-0x000007FEF620E000-0x000007FEF620F000-memory.dmp

    Filesize

    4KB

  • memory/2164-14-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

    Filesize

    9.6MB