Analysis

  • max time kernel
    142s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    18-08-2023 10:42

General

  • Target

    Setup_DriverDoc_2022.exe

  • Size

    6.0MB

  • MD5

    c65a354ac28f2f45c7ca8a38e4f778d6

  • SHA1

    42d84f6be5cfa1503dc7bd8275073872d71a4fc0

  • SHA256

    396cb9e17c57f09c4afab97f91e72011e3f115b15e764c39d26473d92fe2c45e

  • SHA512

    7acba2651fb1378a97c47ce6723808235ddd74d2cb736f5fb6f28a241f3b33188e9a511c6be2eb3ca8e7cad68c05a76a0c853edc5a417a16aacd5c0388950017

  • SSDEEP

    98304:KSi1jH0UJukUYMwioEgGU9KM+ZFNIO05p0oO2gz8+fyTx:MUvkUMiij9KM+7Npc0R4+KTx

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup_DriverDoc_2022.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup_DriverDoc_2022.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Users\Admin\AppData\Local\Temp\is-45NAR.tmp\Setup_DriverDoc_2022.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-45NAR.tmp\Setup_DriverDoc_2022.tmp" /SL5="$80122,5347251,879104,C:\Users\Admin\AppData\Local\Temp\Setup_DriverDoc_2022.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-45NAR.tmp\Setup_DriverDoc_2022.tmp

    Filesize

    3.1MB

    MD5

    d70a98daf7a810ee18ce451ec673e399

    SHA1

    274dff37313f3fbdf82dfc4afd94582359b79fee

    SHA256

    9621346beee2a257b1966b6dc3f1f850d54ae0746bf1718d35c966649ac9b340

    SHA512

    a246aa8979a7bc1a8ae6d1c5ac637939e7ab3380484cb78a3fc98fe9ceccb51cb5d6dfe787ece6bb1420450741c0734a049849dac7242679b8660e71acf00e60

  • \Users\Admin\AppData\Local\Temp\is-45NAR.tmp\Setup_DriverDoc_2022.tmp

    Filesize

    3.1MB

    MD5

    d70a98daf7a810ee18ce451ec673e399

    SHA1

    274dff37313f3fbdf82dfc4afd94582359b79fee

    SHA256

    9621346beee2a257b1966b6dc3f1f850d54ae0746bf1718d35c966649ac9b340

    SHA512

    a246aa8979a7bc1a8ae6d1c5ac637939e7ab3380484cb78a3fc98fe9ceccb51cb5d6dfe787ece6bb1420450741c0734a049849dac7242679b8660e71acf00e60

  • memory/1448-61-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/1448-66-0x0000000000400000-0x000000000071E000-memory.dmp

    Filesize

    3.1MB

  • memory/1448-67-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/1448-77-0x0000000000400000-0x000000000071E000-memory.dmp

    Filesize

    3.1MB

  • memory/1448-91-0x0000000000400000-0x000000000071E000-memory.dmp

    Filesize

    3.1MB

  • memory/2676-54-0x0000000000400000-0x00000000004E4000-memory.dmp

    Filesize

    912KB

  • memory/2676-65-0x0000000000400000-0x00000000004E4000-memory.dmp

    Filesize

    912KB