09c91862d6e40c74f6edc233440b5f691d498ede6fb00bb43d309ca24e4e67b9

Analysis

max time kernel
839s
max time network
845s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051.exe
Size

138KB
MD5

911d5905cbe1dd462f171b7167cd15b9
SHA1

bca38ab2f4b461e25e4686cfe523d3b0ed2d1cd0
SHA256

8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051
SHA512

c60c274360040b2385fcfbc1f9cbc85cd48c9872d0cadcfbe0343efb16e5401af1b74159ecd29d5adeb519c2818bde022fd21b20c12e4dfb274351733d38b7d1
SSDEEP

1536:IhcFu21x8xUoDq88z/1h5jOla6H7uTnkwwZI0qXAREZ+QOS4D0rtJ/lxABC:7DnoDjbin/w1O3D5J/lxABC

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

msiexec.exe

pid process

2352 msiexec.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051.exe

pid process

2676 8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051.exe

pid	process
2352	msiexec.exe

pid	process
2676	8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051.exe

description	pid	process	target process
PID 2676 wrote to memory of 2352	2676	8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051.exe	msiexec.exe
PID 2676 wrote to memory of 2352	2676	8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051.exe	msiexec.exe
PID 2676 wrote to memory of 2352	2676	8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051.exe	msiexec.exe
PID 2676 wrote to memory of 2352	2676	8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051.exe	msiexec.exe
PID 2676 wrote to memory of 2352	2676	8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051.exe
"C:\Users\Admin\AppData\Local\Temp\8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\system32\msiexec.exe
  "C:\Windows\system32\msiexec.exe"
  2⤵
  - Deletes itself
  PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\msiexec.exe

Filesize
125KB

MD5
a190da6546501cb4146bbcc0b6a3f48b

SHA1
443aac22d57edd4ef893e2a245b356cba5b2c2dd

SHA256
5ae0bf71e770c2959fe2022c43e4c6f43e361089a3431aa3180ebf4ec0465cac

SHA512
688a548138a961b29fb740a8c18b32afdfe115da7f8fc579041a771e4eb6da0d6370698e89d2fc74f236153b1919e2d70f51819054cfa43a5386fb8222b8c640

Download Submit
memory/2352-309-0x0000000000230000-0x0000000000258000-memory.dmp

Filesize
160KB

Download
memory/2352-311-0x0000000000230000-0x0000000000258000-memory.dmp

Filesize
160KB

Download
memory/2352-343-0x0000000000230000-0x0000000000258000-memory.dmp

Filesize
160KB

Download
memory/2352-344-0x0000000000230000-0x0000000000258000-memory.dmp

Filesize
160KB

Download
memory/2352-487-0x0000000000230000-0x0000000000258000-memory.dmp

Filesize
160KB

Download
memory/2352-618-0x0000000000230000-0x0000000000258000-memory.dmp

Filesize
160KB

Download
memory/2352-619-0x0000000000230000-0x0000000000258000-memory.dmp

Filesize
160KB

Download
memory/2352-345-0x0000000000230000-0x0000000000258000-memory.dmp

Filesize
160KB

Download
memory/2352-342-0x0000000000230000-0x0000000000258000-memory.dmp

Filesize
160KB

Download
memory/2676-29-0x0000000001020000-0x0000000001021000-memory.dmp

Filesize
4KB

Download
memory/2676-105-0x0000000001030000-0x0000000001031000-memory.dmp

Filesize
4KB

Download
memory/2676-25-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Filesize
4KB

Download
memory/2676-24-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/2676-23-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/2676-2-0x0000000000A50000-0x0000000000B7D000-memory.dmp

Filesize
1.2MB

Download
memory/2676-27-0x0000000001000000-0x0000000001001000-memory.dmp

Filesize
4KB

Download
memory/2676-26-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download
memory/2676-106-0x0000000001240000-0x0000000001241000-memory.dmp

Filesize
4KB

Download
memory/2676-107-0x0000000001350000-0x00000000013C1000-memory.dmp

Filesize
452KB

Download
memory/2676-0-0x0000000000360000-0x00000000003FF000-memory.dmp

Filesize
636KB

Download
memory/2676-21-0x00000000015F0000-0x00000000016B9000-memory.dmp

Filesize
804KB

Download
memory/2676-28-0x0000000001010000-0x0000000001011000-memory.dmp

Filesize
4KB

Download
memory/2676-22-0x00000000022C0000-0x00000000023C9000-memory.dmp

Filesize
1.0MB

Download
memory/2676-3-0x0000000000160000-0x0000000000177000-memory.dmp

Filesize
92KB

Download
memory/2676-1-0x0000000000140000-0x000000000015F000-memory.dmp

Filesize
124KB

Download