Overview

overview

8

Static

static

dccc8eee4a...a0.exe

windows7-x64

8

dccc8eee4a...a0.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 03:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    dccc8eee4aa4fdb0f2dc890534a0c576a1053d1ab99ccd55580354b9db12fda0.exe

  • Size

    312KB

  • MD5

    34dd7c33483366da4c4fe885abe91d98

  • SHA1

    fd9eb6920bb87796352bf1747e313a261e3cfdfb

  • SHA256

    dccc8eee4aa4fdb0f2dc890534a0c576a1053d1ab99ccd55580354b9db12fda0

  • SHA512

    73cbdb4eeb76bcb8176ded294b395317bd78a192d5959405255df697ae2033a1b1ed8b129e995d60a710931d24cdee4be6d984ba9ed7353c6f265de7dc891df0

  • SSDEEP

    6144:+6EwwJWwVwrgkEF97KCzqMvoB8j9J/d57jHhcOMhPC:zEPWKwreP7fzDAgzl5Hhcx

Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dccc8eee4aa4fdb0f2dc890534a0c576a1053d1ab99ccd55580354b9db12fda0.exe
    "C:\Users\Admin\AppData\Local\Temp\dccc8eee4aa4fdb0f2dc890534a0c576a1053d1ab99ccd55580354b9db12fda0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\ProgramData\nDlDdBdAhFd06504\nDlDdBdAhFd06504.exe
      "C:\ProgramData\nDlDdBdAhFd06504\nDlDdBdAhFd06504.exe" "C:\Users\Admin\AppData\Local\Temp\dccc8eee4aa4fdb0f2dc890534a0c576a1053d1ab99ccd55580354b9db12fda0.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:768

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\nDlDdBdAhFd06504\nDlDdBdAhFd06504.exe
          Filesize

          312KB

          MD5

          5dc36cbe6f2c63621fe8b28e38c712d1

          SHA1

          afee76802d4253edadaca04c07e6717ad6a3bf86

          SHA256

          912703cf37aa88bf50fa5ccea9a838bd2e332365d445ce28f060da42d036fdb4

          SHA512

          bc603d644d9f1b4e33dca02705e592b7e44436467ea2513473c7fcde4da242000855504ee746e5e5fb8981ff112b46c812693d12e5d8c234e84162fd6bb55388

          Download Submit

        • C:\ProgramData\nDlDdBdAhFd06504\nDlDdBdAhFd06504.exe
          Filesize

          312KB

          MD5

          5dc36cbe6f2c63621fe8b28e38c712d1

          SHA1

          afee76802d4253edadaca04c07e6717ad6a3bf86

          SHA256

          912703cf37aa88bf50fa5ccea9a838bd2e332365d445ce28f060da42d036fdb4

          SHA512

          bc603d644d9f1b4e33dca02705e592b7e44436467ea2513473c7fcde4da242000855504ee746e5e5fb8981ff112b46c812693d12e5d8c234e84162fd6bb55388

          Download Submit

        • \ProgramData\nDlDdBdAhFd06504\nDlDdBdAhFd06504.exe
          Filesize

          312KB

          MD5

          5dc36cbe6f2c63621fe8b28e38c712d1

          SHA1

          afee76802d4253edadaca04c07e6717ad6a3bf86

          SHA256

          912703cf37aa88bf50fa5ccea9a838bd2e332365d445ce28f060da42d036fdb4

          SHA512

          bc603d644d9f1b4e33dca02705e592b7e44436467ea2513473c7fcde4da242000855504ee746e5e5fb8981ff112b46c812693d12e5d8c234e84162fd6bb55388

          Download Submit

        • \ProgramData\nDlDdBdAhFd06504\nDlDdBdAhFd06504.exe
          Filesize

          312KB

          MD5

          5dc36cbe6f2c63621fe8b28e38c712d1

          SHA1

          afee76802d4253edadaca04c07e6717ad6a3bf86

          SHA256

          912703cf37aa88bf50fa5ccea9a838bd2e332365d445ce28f060da42d036fdb4

          SHA512

          bc603d644d9f1b4e33dca02705e592b7e44436467ea2513473c7fcde4da242000855504ee746e5e5fb8981ff112b46c812693d12e5d8c234e84162fd6bb55388

          Download Submit

        • memory/768-67-0x0000000000400000-0x00000000004FC000-memory.dmp

          Filesize

          1008KB

          Download

        • memory/768-68-0x00000000006AB000-0x00000000006DA000-memory.dmp

          Filesize

          188KB

          Download

        • memory/768-70-0x00000000006AB000-0x00000000006DA000-memory.dmp

          Filesize

          188KB

          Download

        • memory/1812-54-0x0000000076091000-0x0000000076093000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1812-55-0x0000000000400000-0x00000000004FC000-memory.dmp

          Filesize

          1008KB

          Download

        • memory/1812-65-0x0000000000400000-0x00000000004FC000-memory.dmp

          Filesize

          1008KB

          Download

        • memory/1812-66-0x00000000005DB000-0x000000000060A000-memory.dmp

          Filesize

          188KB

          Download

        • memory/1812-69-0x00000000005DB000-0x000000000060A000-memory.dmp

          Filesize

          188KB

          Download