Overview

overview

6

Static

static

a90d2d7bbb...bb.exe

windows7-x64

6

a90d2d7bbb...bb.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    322s
  • max time network
    346s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 00:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a90d2d7bbb1c48d87dcd336aed3531fa6f08f4decfaf88446ba5b0608188c2bb.exe

  • Size

    26KB

  • MD5

    00ff0fb6f1c44d01d157a8bcd21eca80

  • SHA1

    3b1caaedff41bfca1e447f367bb716c56ce2660c

  • SHA256

    a90d2d7bbb1c48d87dcd336aed3531fa6f08f4decfaf88446ba5b0608188c2bb

  • SHA512

    7c47950ab7c9c67e13be81815ca7c2601bb3f935b57ea196b9becd9749f63792b50fd7d97759885ece355c45a65718e804c7f55211a4178a8ebc7f26f67b45f8

  • SSDEEP

    768:s1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:2fgLdQAQfcfymN

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1936
      • C:\Users\Admin\AppData\Local\Temp\a90d2d7bbb1c48d87dcd336aed3531fa6f08f4decfaf88446ba5b0608188c2bb.exe
        "C:\Users\Admin\AppData\Local\Temp\a90d2d7bbb1c48d87dcd336aed3531fa6f08f4decfaf88446ba5b0608188c2bb.exe"
        2⤵
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2876
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3392
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:4424

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2876-133-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

        Download

      • memory/2876-135-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

        Download

      • memory/3392-132-0x0000000000000000-mapping.dmp

        Download

      • memory/4424-134-0x0000000000000000-mapping.dmp

        Download