Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/03/2025, 06:25
General
-
Target
34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe
-
Size
580KB
-
MD5
8cfc3f50d92b1919d85306fa26d53a73
-
SHA1
9bcdae674f2508df2e9c98fe441d4e0fa9bb85e4
-
SHA256
34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4
-
SHA512
04c62010776379fb46f90081db7cc4040ccaae373610475088fd891bc487d8e3a4c7396d73a1941538c398bd639b04d1e9cd0271ed596eaa80cd2b62162dff55
-
SSDEEP
12288:YbD5arFJwK6hMJ6ZzHFZfc28beMGTfZuqb7J:rBJwdhMJ6ZzHrfcsMGTfZ5PJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe"C:\Users\Admin\AppData\Local\Temp\34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe"C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
580KB
MD536b242fc2bbe7b8f16e3eafbe31cab71
SHA1851fd6432186c103c55c23077c8d45bca51dc148
SHA2563860e2f33e606f44ee0a618ca45713c12146edc3572302afc7586ea3675fc1e4
SHA51214c1046352bd202075148715ff8fdbbb7c09d96418819e7d16a99ebc19a2fe28c5c0ddd2c56a8854f415caa03d0200aefb926579bddd477da7d463169d014f0f
-
Filesize
4KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
160KB
-
Filesize
696KB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
344KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
6.9MB
-
Filesize
592KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
592KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB