e46ebdbfdbabb3aeec9b7fa8aa7268d23d3d9f52d5ba3620067eb8f67dde95e3

Analysis

max time kernel
45s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

multi tool-taventix.exe
Size

39.9MB
MD5

41c20e17a7839c5396f0ad89c31d9673
SHA1

20a277bc58614273bcbde1b82eafdbe9e9803e80
SHA256

e46ebdbfdbabb3aeec9b7fa8aa7268d23d3d9f52d5ba3620067eb8f67dde95e3
SHA512

0eeaee57ee70acbbaa0daba71ac2de0f797a7fd29d2d5bb74ca5a753a08a0bbcae10abd6852ee05c80a0c76fde71697f176e7d698ecfa0a1aeaa732a09ad123d
SSDEEP

786432:E/68iHKFYQlihww1JU0iGTTMlhmDI6I9ITC5aEMMkqh3:E/6fqFYQlXw1GtGTmn6PWIEMqh3

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1900	Stub.exe

Loads dropped DLL 2 IoCs

pid	Process
1416	multi tool-taventix.exe
1900	Stub.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	mstsc.exe
File opened (read-only)	\??\G:	mstsc.exe
File opened (read-only)	\??\H:	mstsc.exe
File opened (read-only)	\??\N:	mstsc.exe
File opened (read-only)	\??\O:	mstsc.exe
File opened (read-only)	\??\R:	mstsc.exe
File opened (read-only)	\??\W:	mstsc.exe
File opened (read-only)	\??\I:	mstsc.exe
File opened (read-only)	\??\M:	mstsc.exe
File opened (read-only)	\??\S:	mstsc.exe
File opened (read-only)	\??\X:	mstsc.exe
File opened (read-only)	\??\B:	mstsc.exe
File opened (read-only)	\??\J:	mstsc.exe
File opened (read-only)	\??\L:	mstsc.exe
File opened (read-only)	\??\T:	mstsc.exe
File opened (read-only)	\??\Y:	mstsc.exe
File opened (read-only)	\??\A:	mstsc.exe
File opened (read-only)	\??\K:	mstsc.exe
File opened (read-only)	\??\P:	mstsc.exe
File opened (read-only)	\??\Q:	mstsc.exe
File opened (read-only)	\??\U:	mstsc.exe
File opened (read-only)	\??\V:	mstsc.exe
File opened (read-only)	\??\Z:	mstsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1900	1416	multi tool-taventix.exe	31
PID 1416 wrote to memory of 1900	1416	multi tool-taventix.exe	31
PID 1416 wrote to memory of 1900	1416	multi tool-taventix.exe	31

C:\Users\Admin\AppData\Local\Temp\multi tool-taventix.exe
"C:\Users\Admin\AppData\Local\Temp\multi tool-taventix.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Local\Temp\onefile_1416_133727014216716000\Stub.exe
  "C:\Users\Admin\AppData\Local\Temp\multi tool-taventix.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1900

C:\Windows\system32\mstsc.exe
"C:\Windows\system32\mstsc.exe"
1⤵
- Enumerates connected drives
PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_1416_133727014216716000\python310.dll

Filesize
4.3MB

MD5
e4533934b37e688106beac6c5919281e

SHA1
ada39f10ef0bbdcf05822f4260e43d53367b0017

SHA256
2bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5

SHA512
fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9

Download Submit
memory/1416-73-0x000000013FF00000-0x000000014270A000-memory.dmp

Filesize
40.0MB

Download
memory/1900-39-0x000000013F3B0000-0x0000000144D8A000-memory.dmp

Filesize
89.9MB

Download