Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 03:03

General

  • Target

    911d5905cbe1dd462f171b7167cd15b9.exe

  • Size

    138KB

  • MD5

    911d5905cbe1dd462f171b7167cd15b9

  • SHA1

    bca38ab2f4b461e25e4686cfe523d3b0ed2d1cd0

  • SHA256

    8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051

  • SHA512

    c60c274360040b2385fcfbc1f9cbc85cd48c9872d0cadcfbe0343efb16e5401af1b74159ecd29d5adeb519c2818bde022fd21b20c12e4dfb274351733d38b7d1

  • SSDEEP

    1536:IhcFu21x8xUoDq88z/1h5jOla6H7uTnkwwZI0qXAREZ+QOS4D0rtJ/lxABC:7DnoDjbin/w1O3D5J/lxABC

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\911d5905cbe1dd462f171b7167cd15b9.exe
    "C:\Users\Admin\AppData\Local\Temp\911d5905cbe1dd462f171b7167cd15b9.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Windows\system32\msiexec.exe
      "C:\Windows\system32\msiexec.exe"
      2⤵
      • Deletes itself
      PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\msiexec.exe

    Filesize

    125KB

    MD5

    a190da6546501cb4146bbcc0b6a3f48b

    SHA1

    443aac22d57edd4ef893e2a245b356cba5b2c2dd

    SHA256

    5ae0bf71e770c2959fe2022c43e4c6f43e361089a3431aa3180ebf4ec0465cac

    SHA512

    688a548138a961b29fb740a8c18b32afdfe115da7f8fc579041a771e4eb6da0d6370698e89d2fc74f236153b1919e2d70f51819054cfa43a5386fb8222b8c640

  • memory/2980-383-0x0000000000540000-0x0000000000568000-memory.dmp

    Filesize

    160KB

  • memory/2980-388-0x0000000000540000-0x0000000000568000-memory.dmp

    Filesize

    160KB

  • memory/2980-505-0x0000000000540000-0x0000000000568000-memory.dmp

    Filesize

    160KB

  • memory/2980-537-0x0000000009980000-0x0000000009A00000-memory.dmp

    Filesize

    512KB

  • memory/2980-539-0x00000000097A0000-0x0000000009820000-memory.dmp

    Filesize

    512KB

  • memory/2980-540-0x0000000009C20000-0x0000000009CA0000-memory.dmp

    Filesize

    512KB

  • memory/2980-541-0x0000000009B60000-0x0000000009BE0000-memory.dmp

    Filesize

    512KB

  • memory/2980-542-0x00000000094E0000-0x0000000009560000-memory.dmp

    Filesize

    512KB

  • memory/2980-543-0x0000000009D70000-0x0000000009DF0000-memory.dmp

    Filesize

    512KB

  • memory/2980-544-0x0000000009CC0000-0x0000000009D40000-memory.dmp

    Filesize

    512KB

  • memory/2980-545-0x0000000009EE0000-0x0000000009F60000-memory.dmp

    Filesize

    512KB

  • memory/2980-546-0x0000000009F80000-0x000000000A000000-memory.dmp

    Filesize

    512KB

  • memory/2980-547-0x000000000A0A0000-0x000000000A120000-memory.dmp

    Filesize

    512KB

  • memory/2980-538-0x0000000009A70000-0x0000000009AF0000-memory.dmp

    Filesize

    512KB

  • memory/2996-41-0x0000000005590000-0x0000000005699000-memory.dmp

    Filesize

    1.0MB

  • memory/2996-26-0x0000000000760000-0x0000000000761000-memory.dmp

    Filesize

    4KB

  • memory/2996-21-0x0000000000490000-0x0000000000491000-memory.dmp

    Filesize

    4KB

  • memory/2996-22-0x0000000000720000-0x0000000000721000-memory.dmp

    Filesize

    4KB

  • memory/2996-23-0x0000000000730000-0x0000000000731000-memory.dmp

    Filesize

    4KB

  • memory/2996-24-0x0000000000740000-0x0000000000741000-memory.dmp

    Filesize

    4KB

  • memory/2996-25-0x0000000000750000-0x0000000000751000-memory.dmp

    Filesize

    4KB

  • memory/2996-40-0x0000000001880000-0x0000000001949000-memory.dmp

    Filesize

    804KB

  • memory/2996-27-0x0000000000770000-0x0000000000771000-memory.dmp

    Filesize

    4KB

  • memory/2996-3-0x0000000000430000-0x0000000000447000-memory.dmp

    Filesize

    92KB

  • memory/2996-192-0x0000000000780000-0x0000000000781000-memory.dmp

    Filesize

    4KB

  • memory/2996-193-0x00000000011D0000-0x00000000011D1000-memory.dmp

    Filesize

    4KB

  • memory/2996-194-0x00000000015D0000-0x0000000001641000-memory.dmp

    Filesize

    452KB

  • memory/2996-0-0x0000000000180000-0x000000000021F000-memory.dmp

    Filesize

    636KB

  • memory/2996-1-0x0000000000220000-0x000000000023F000-memory.dmp

    Filesize

    124KB

  • memory/2996-2-0x00000000005A0000-0x00000000006CD000-memory.dmp

    Filesize

    1.2MB