b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Analysis

max time kernel
149s
max time network
161s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Worm/Blaster/8a17f336f86e81f04d8e66fa23f9b36a.exe
Size

162KB
MD5

8a17f336f86e81f04d8e66fa23f9b36a
SHA1

f9465db9573fea92a9224b7600872e8a6d864cbf
SHA256

93bce533854e3dd53551048403450ae1f03f44c938b1bacaf3d58c45e7e4d957
SHA512

7ee88762e687403ff08d27c8bbe63f0b8524af0889f34ac044c7d8e0393f8735438da88e6dcf2e0826d48dd8648a3a48fc8c68c8a4b91dd55c995af9a8c5e5e4
SSDEEP

3072:6bhU1YeFd+bShONEk1ee1eeeemidw4kEPHQdTUQLeosRYghjudju2fZTiusOChCW:6bhUmeFd7W1ee1eeeem+LkEPHg6osRYg

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Contacts a large (1661) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 2 IoCs

pid	Process
2700	newfile1.exe
2692	newfile1.exe

Loads dropped DLL 4 IoCs

pid	Process
2644	8a17f336f86e81f04d8e66fa23f9b36a.exe
2644	8a17f336f86e81f04d8e66fa23f9b36a.exe
2644	8a17f336f86e81f04d8e66fa23f9b36a.exe
2644	8a17f336f86e81f04d8e66fa23f9b36a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\windows auto update = "msblast.exe"	newfile1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\windows auto update = "msblast.exe"	newfile1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\newfile1.exe	8a17f336f86e81f04d8e66fa23f9b36a.exe
File created	C:\Windows\SysWOW64\newfile2.exe	8a17f336f86e81f04d8e66fa23f9b36a.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral13/files/0x000b0000000120dc-2.dat	upx
behavioral13/memory/2644-4-0x0000000002100000-0x0000000002109000-memory.dmp	upx
behavioral13/memory/2700-24-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral13/memory/2692-23-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral13/memory/2692-25-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral13/memory/2692-26-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral13/memory/2692-27-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral13/memory/2692-28-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral13/memory/2692-29-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral13/memory/2692-30-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral13/memory/2692-31-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral13/memory/2692-32-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral13/memory/2692-33-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral13/memory/2692-34-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral13/memory/2692-35-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral13/memory/2692-36-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral13/memory/2692-37-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral13/memory/2692-38-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral13/memory/2692-39-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newfile1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a17f336f86e81f04d8e66fa23f9b36a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newfile1.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2700	2644	8a17f336f86e81f04d8e66fa23f9b36a.exe	31
PID 2644 wrote to memory of 2700	2644	8a17f336f86e81f04d8e66fa23f9b36a.exe	31
PID 2644 wrote to memory of 2700	2644	8a17f336f86e81f04d8e66fa23f9b36a.exe	31
PID 2644 wrote to memory of 2700	2644	8a17f336f86e81f04d8e66fa23f9b36a.exe	31
PID 2644 wrote to memory of 2692	2644	8a17f336f86e81f04d8e66fa23f9b36a.exe	32
PID 2644 wrote to memory of 2692	2644	8a17f336f86e81f04d8e66fa23f9b36a.exe	32
PID 2644 wrote to memory of 2692	2644	8a17f336f86e81f04d8e66fa23f9b36a.exe	32
PID 2644 wrote to memory of 2692	2644	8a17f336f86e81f04d8e66fa23f9b36a.exe	32

C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Worm\Blaster\8a17f336f86e81f04d8e66fa23f9b36a.exe
"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Worm\Blaster\8a17f336f86e81f04d8e66fa23f9b36a.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\newfile1.exe
  "C:\Windows\system32\newfile1.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2700
- C:\Windows\SysWOW64\newfile1.exe
  "C:\Windows\system32\newfile1.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\newfile1.exe

Filesize
6KB

MD5
5ae700c1dffb00cef492844a4db6cd69

SHA1
bed8e439f28a1a0d3876366cbd76a43cdccf60fa

SHA256
258f82166d20c68497a66d82349fc81899fde8fe8c1cc66e59f739a9ea2c95a9

SHA512
2cc1ec68df94edc561dd08c4e3e498f925907955b6e54a877b8bc1fb0dd48a6276f41e44756ed286404f6a54f55edb03f8765b21e88a32fd4ca1eb0c6b422980

Download Submit
memory/2644-20-0x0000000002110000-0x0000000002119000-memory.dmp

Filesize
36KB

Download
memory/2644-4-0x0000000002100000-0x0000000002109000-memory.dmp

Filesize
36KB

Download
memory/2644-10-0x0000000002100000-0x0000000002109000-memory.dmp

Filesize
36KB

Download
memory/2644-15-0x0000000002110000-0x0000000002119000-memory.dmp

Filesize
36KB

Download
memory/2644-22-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2692-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2692-32-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2692-25-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2692-26-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2692-39-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2692-28-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2692-29-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2692-30-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2692-31-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2692-23-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2692-33-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2692-34-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2692-35-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2692-36-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2692-37-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2692-38-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2700-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads