Resubmissions

18/08/2023, 09:22

230818-lcavdaaa9w8

17/08/2023, 20:37

230817-zemhvaeg7w8

Analysis

  • max time kernel
    756s
  • max time network
    862s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2023, 09:22

General

  • Target
    install.exe
  • Size 302.7MB
  • Sample230818-lcavdaaa9w
  • SHA256 250fe7be536bb8674dd7e0e7c4de2ca1e3311ed657181d950dda6590a3bded51
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\install.exe
    "C:\Users\Admin\AppData\Local\Temp\install.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1020
    • C:\Users\Admin\AppData\Local\Temp\dist2019-win-x64.exe
      "C:\Users\Admin\AppData\Local\Temp\dist2019-win-x64.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3704
      • C:\Users\Public\Documents\Wondershare\NFWCHK.exe
        C:\Users\Public\Documents\Wondershare\NFWCHK.exe
        3⤵
        • Executes dropped EXE
        PID:3312
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:21624

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        __PSScriptPolicyTest_up0rtpy0.qjt.ps1

        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_up0rtpy0.qjt.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512

        dist2019-win-x64.exe

        • Path C:\Users\Admin\AppData\Local\Temp\dist2019-win-x64.exe
        • Size 1.6MB
        • SHA256 4e555b1b5102564811a8ecb229161201e4f11f79639a50fa70e3e9aae40973ee
        • MD5 SHA1 SHA512 SSDEEP

        dist2019-win-x64.exe

        • Path C:\Users\Admin\AppData\Local\Temp\dist2019-win-x64.exe
        • Size 1.6MB
        • SHA256 4e555b1b5102564811a8ecb229161201e4f11f79639a50fa70e3e9aae40973ee
        • MD5 SHA1 SHA512 SSDEEP

        dist2019-win-x64.exe

        • Path C:\Users\Admin\AppData\Local\Temp\dist2019-win-x64.exe
        • Size 1.6MB
        • SHA256 4e555b1b5102564811a8ecb229161201e4f11f79639a50fa70e3e9aae40973ee
        • MD5 SHA1 SHA512 SSDEEP

        wsWAE.log

        • Path C:\Users\Admin\AppData\Local\Temp\wsWAE.log
        • Size 496B
        • SHA256 e378c6de3e06bdb48f85cb0edaa381607c910ffda2617e1925515661b409579f
        • MD5 SHA1 SHA512

        wsduilib.log

        • Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
        • Size 2KB
        • SHA256 e8bbe0edb5a0ac03ac81d77c4dcf317b83ee1d9d9a295185f8887cadf4327dac
        • MD5 SHA1 SHA512

        wsduilib.log

        • Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
        • Size 7KB
        • SHA256 62e94e0e88354bdf4376e0959e5662de47bb2b2c8184d809f5bbdb03f9d78508
        • MD5 SHA1 SHA512 SSDEEP

        NFWCHK.exe

        • Path C:\Users\Public\Documents\Wondershare\NFWCHK.exe
        • Size 7KB
        • SHA256 43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146
        • MD5 SHA1 SHA512 SSDEEP

        NFWCHK.exe

        • Path C:\Users\Public\Documents\Wondershare\NFWCHK.exe
        • Size 7KB
        • SHA256 43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146
        • MD5 SHA1 SHA512 SSDEEP

        NFWCHK.exe.config

        • Path C:\Users\Public\Documents\Wondershare\NFWCHK.exe.config
        • Size 229B
        • SHA256 9c1212bc648a2533b53a2d0afcec518846d97630afb013742a9622f0df7b04fc
        • MD5 SHA1 SHA512

        memory/1020-145-0x000000002E930000-0x000000002E952000-memory.dmp

        memory/1020-144-0x000000002EAD0000-0x000000002EAE0000-memory.dmp

        memory/1020-133-0x00007FFDD41F0000-0x00007FFDD4CB1000-memory.dmp

        memory/1020-134-0x0000000000E30000-0x0000000001E30000-memory.dmp

        memory/1020-1003-0x00007FFDD41F0000-0x00007FFDD4CB1000-memory.dmp

        memory/1020-1021-0x000000002EAD0000-0x000000002EAE0000-memory.dmp

        memory/3312-1007-0x0000000000B50000-0x0000000000B68000-memory.dmp

        memory/3312-1016-0x000000001B670000-0x000000001B678000-memory.dmp

        memory/3312-1005-0x000000001AEB0000-0x000000001AED4000-memory.dmp

        memory/3312-1008-0x00007FFDC6260000-0x00007FFDC6C01000-memory.dmp

        memory/3312-1010-0x000000001AF00000-0x000000001AF20000-memory.dmp

        memory/3312-1009-0x0000000000B70000-0x0000000000B80000-memory.dmp

        memory/3312-1011-0x000000001AF20000-0x000000001B22E000-memory.dmp

        memory/3312-1012-0x000000001B6E0000-0x000000001B729000-memory.dmp

        memory/3312-1013-0x000000001B7A0000-0x000000001B802000-memory.dmp

        memory/3312-1014-0x000000001BCE0000-0x000000001C1AE000-memory.dmp

        memory/3312-1015-0x000000001C250000-0x000000001C2EC000-memory.dmp

        memory/3312-1006-0x00007FFDC6260000-0x00007FFDC6C01000-memory.dmp

        memory/3312-1017-0x000000001C630000-0x000000001C66E000-memory.dmp

        memory/3312-1019-0x00007FFDC6260000-0x00007FFDC6C01000-memory.dmp

        memory/3312-1004-0x0000000000010000-0x0000000000018000-memory.dmp

        memory/21624-1038-0x00007FFDD41F0000-0x00007FFDD4CB1000-memory.dmp

        memory/21624-1039-0x0000023964FF0000-0x0000023965000000-memory.dmp

        memory/21624-1040-0x0000023964FF0000-0x0000023965000000-memory.dmp

        memory/21624-1041-0x0000023967600000-0x0000023967644000-memory.dmp

        memory/21624-1042-0x00000239676D0000-0x0000023967746000-memory.dmp

        memory/21624-1043-0x00007FFDD41F0000-0x00007FFDD4CB1000-memory.dmp

        memory/21624-1044-0x0000023964FF0000-0x0000023965000000-memory.dmp

        memory/21624-1045-0x0000023964FF0000-0x0000023965000000-memory.dmp