09c91862d6e40c74f6edc233440b5f691d498ede6fb00bb43d309ca24e4e67b9

Analysis

max time kernel
839s
max time network
842s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2.exe
Size

138KB
MD5

6f772eb660bc05fc26df86c98ca49abc
SHA1

8da75dd328c195b84f15740a33fc9888af4da2be
SHA256

7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2
SHA512

3e028cecf08ed4fe0100a7587f04ba4c4cebb023b371cc4e793a7dfb7be64a4d2ef8066fc352ea834c239cb7c5836626673e02fbaa63f4631b71d40c4cc284a1
SSDEEP

1536:USX6DdHTs0Zwboo0z29sHH3ga/7/nvvgDD0jj0ZT8fS4D0rF4p4sxVZ7:36BZwlOn4DdTBDiusxVZ7

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

msiexec.exe

pid process

3544 msiexec.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2.exe

pid process

692 7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2.exe

pid	process
3544	msiexec.exe

pid	process
692	7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2.exe

description	pid	process	target process
PID 692 wrote to memory of 3544	692	7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2.exe	msiexec.exe
PID 692 wrote to memory of 3544	692	7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2.exe	msiexec.exe
PID 692 wrote to memory of 3544	692	7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2.exe	msiexec.exe
PID 692 wrote to memory of 3544	692	7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2.exe	msiexec.exe
PID 692 wrote to memory of 3544	692	7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2.exe
"C:\Users\Admin\AppData\Local\Temp\7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:692
- C:\Windows\system32\msiexec.exe
  "C:\Windows\system32\msiexec.exe"
  2⤵
  - Deletes itself
  PID:3544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\msiexec.exe

Filesize
125KB

MD5
a190da6546501cb4146bbcc0b6a3f48b

SHA1
443aac22d57edd4ef893e2a245b356cba5b2c2dd

SHA256
5ae0bf71e770c2959fe2022c43e4c6f43e361089a3431aa3180ebf4ec0465cac

SHA512
688a548138a961b29fb740a8c18b32afdfe115da7f8fc579041a771e4eb6da0d6370698e89d2fc74f236153b1919e2d70f51819054cfa43a5386fb8222b8c640

Download Submit
memory/692-31-0x0000000001340000-0x0000000001341000-memory.dmp

Filesize
4KB

Download
memory/692-32-0x00000000016A0000-0x0000000001711000-memory.dmp

Filesize
452KB

Download
memory/692-2-0x0000000000540000-0x000000000066D000-memory.dmp

Filesize
1.2MB

Download
memory/692-24-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Filesize
4KB

Download
memory/692-30-0x0000000001330000-0x0000000001331000-memory.dmp

Filesize
4KB

Download
memory/692-21-0x00000000014B0000-0x0000000001579000-memory.dmp

Filesize
804KB

Download
memory/692-3-0x00000000003E0000-0x00000000003F7000-memory.dmp

Filesize
92KB

Download
memory/692-1-0x0000000000140000-0x000000000015F000-memory.dmp

Filesize
124KB

Download
memory/692-22-0x0000000003B50000-0x0000000003C59000-memory.dmp

Filesize
1.0MB

Download
memory/692-29-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/692-28-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/692-27-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/692-26-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/692-25-0x0000000000C10000-0x0000000000C11000-memory.dmp

Filesize
4KB

Download
memory/692-23-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/692-0-0x0000000000340000-0x00000000003DF000-memory.dmp

Filesize
636KB

Download
memory/3544-671-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-516-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-710-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-690-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-657-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-639-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-602-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-566-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-522-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-515-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-509-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-508-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-507-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-506-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-505-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-504-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-503-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-502-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-495-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download
memory/3544-484-0x0000000001E50000-0x0000000001E78000-memory.dmp

Filesize
160KB

Download