Overview

overview

10

Static

static

1

d864a359e3...7c.exe

windows7-x64

7

d864a359e3...7c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30-11-2024 01:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d864a359e3a19182e72109fe75408d21b10215938e8be4098c4dbbc8ce0b7c7c.exe

  • Size

    83.6MB

  • MD5

    a91b4875630c4f702ab63f94ed633da4

  • SHA1

    d485e90a501aa11f89f684063e5fbe235937f0bf

  • SHA256

    d864a359e3a19182e72109fe75408d21b10215938e8be4098c4dbbc8ce0b7c7c

  • SHA512

    43e4a19efcb814ae3b418177679fb52d257fd9046b6ac4baaea2fdfecb8627bc80ecdfc8288139d669e639c748f63c043d5b6997147b580d64bab3518524b460

  • SSDEEP

    1572864:ZyM8TruaFhFBQ4aidylq1RFVKl8J/1BbAYqnmy2QPz2Pt0BQGRClJygc:ZyMAeiTFny2ezE0QGiJygc

Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d864a359e3a19182e72109fe75408d21b10215938e8be4098c4dbbc8ce0b7c7c.exe
    "C:\Users\Admin\AppData\Local\Temp\d864a359e3a19182e72109fe75408d21b10215938e8be4098c4dbbc8ce0b7c7c.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\Users\Admin\AppData\Local\Temp\is-2FOA1.tmp\d864a359e3a19182e72109fe75408d21b10215938e8be4098c4dbbc8ce0b7c7c.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-2FOA1.tmp\d864a359e3a19182e72109fe75408d21b10215938e8be4098c4dbbc8ce0b7c7c.tmp" /SL5="$5014E,81954756,1209856,C:\Users\Admin\AppData\Local\Temp\d864a359e3a19182e72109fe75408d21b10215938e8be4098c4dbbc8ce0b7c7c.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-ICV1F.tmp\ExtractedContent.ps1"
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-ICV1F.tmp\ExtractedContent.ps1
    Filesize

    5.5MB

    MD5

    f7e2624867775590018ce9586ac1d4a8

    SHA1

    6e2e80d1bde207734647b48d71dc483ff56a29a1

    SHA256

    0547b50b9070c88c19d054d1d2f084f72fe3717be07265af0ea4ce87ffd8ebc5

    SHA512

    fa8312dbac3b24f3d8d09576084f04e7289f2878bd5b4157328fc51259ca918a8874fa1e60b0f095634abe2f86a64941c74f702ffb52ed80c0310d8622297c2e

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-2FOA1.tmp\d864a359e3a19182e72109fe75408d21b10215938e8be4098c4dbbc8ce0b7c7c.tmp
    Filesize

    3.5MB

    MD5

    6ab2af20157d2f440e8b22982f6247c5

    SHA1

    53c0da8de2ee2c50b79913a876edcd7078897566

    SHA256

    c95f668ab97a0c6650381e0fc1a93aa043e3f899eef09dd7a3b0837a4298838e

    SHA512

    5ed8b96a65c44f7cab604440f21b5e2f331c38d2e7ca3ebb26a9c1750ae5e5690225ec0f6530e6c65589dc639fcbcbf9afa80e85881b6f731118d0089559cb6d

    Download Submit

  • memory/2592-8-0x0000000000180000-0x0000000000181000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2592-11-0x0000000000A40000-0x0000000000DD4000-memory.dmp

    Filesize

    3.6MB

    Download

  • memory/2592-12-0x0000000000180000-0x0000000000181000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2592-14-0x0000000000A40000-0x0000000000DD4000-memory.dmp

    Filesize

    3.6MB

    Download

  • memory/2592-16-0x0000000000A40000-0x0000000000DD4000-memory.dmp

    Filesize

    3.6MB

    Download

  • memory/2592-183-0x0000000000A40000-0x0000000000DD4000-memory.dmp

    Filesize

    3.6MB

    Download

  • memory/2592-185-0x0000000000A40000-0x0000000000DD4000-memory.dmp

    Filesize

    3.6MB

    Download

  • memory/2904-0-0x00000000003F0000-0x0000000000525000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2904-10-0x00000000003F0000-0x0000000000525000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2904-2-0x00000000003F1000-0x0000000000499000-memory.dmp

    Filesize

    672KB

    Download

  • memory/2904-186-0x00000000003F0000-0x0000000000525000-memory.dmp

    Filesize

    1.2MB

    Download