134954a5dfdf9120b99123ab1384f62a11cc76ecd39ce324fe0c31e56b7258ec

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2023, 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UtechSmart_Venus_Setup_v3.0（WIRELESS MMO MOUSE）.exe
Size

1.6MB
MD5

880426675f1c5be064d8bf3dd81e4da2
SHA1

6702ef69ae7a66c25109b00739830c435062215e
SHA256

134954a5dfdf9120b99123ab1384f62a11cc76ecd39ce324fe0c31e56b7258ec
SHA512

d0d9d29182d78d5875c258ed51214af6714b8387f993669cff9733ab8a008753679760ea492ccda6f8b26524f791f7fd5434293bd39d2976f3c8394dd1735a14
SSDEEP

49152:/UbEovVeyCR5O8z5pT1q0LZnzXMV4raxi:xfPzRdzXMV1xi

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5080	UtechSmart_Venus_Setup_v3.0（WIRELESS MMO MOUSE）.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 5080	2072	UtechSmart_Venus_Setup_v3.0（WIRELESS MMO MOUSE）.exe	81
PID 2072 wrote to memory of 5080	2072	UtechSmart_Venus_Setup_v3.0（WIRELESS MMO MOUSE）.exe	81
PID 2072 wrote to memory of 5080	2072	UtechSmart_Venus_Setup_v3.0（WIRELESS MMO MOUSE）.exe	81

C:\Users\Admin\AppData\Local\Temp\UtechSmart_Venus_Setup_v3.0（WIRELESS MMO MOUSE）.exe
"C:\Users\Admin\AppData\Local\Temp\UtechSmart_Venus_Setup_v3.0（WIRELESS MMO MOUSE）.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\is-POMKS.tmp\UtechSmart_Venus_Setup_v3.0（WIRELESS MMO MOUSE）.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-POMKS.tmp\UtechSmart_Venus_Setup_v3.0（WIRELESS MMO MOUSE）.tmp" /SL5="$1200EC,1243858,140800,C:\Users\Admin\AppData\Local\Temp\UtechSmart_Venus_Setup_v3.0（WIRELESS MMO MOUSE）.exe"
  2⤵
  - Executes dropped EXE
  PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-POMKS.tmp\UtechSmart_Venus_Setup_v3.0（WIRELESS MMO MOUSE）.tmp

Filesize
1.1MB

MD5
a4cb46c715d6e7b72755eab92123a3ea

SHA1
1e769da1816daae7d50c8812c59ee20399431a2d

SHA256
686699d59606cd7d2253dff2c92003380361f00b168305e959e66bab9bc725c0

SHA512
8bdce037441eb0ed6aa5fdf7569580b32dd5294b6b4a36a054552e5b46fcbba328b659f2277d3a75d23d9ead64a28d3db2fe49c0b1c13e6d799490ce6509ab1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-POMKS.tmp\UtechSmart_Venus_Setup_v3.0（WIRELESS MMO MOUSE）.tmp

Filesize
1.1MB

MD5
a4cb46c715d6e7b72755eab92123a3ea

SHA1
1e769da1816daae7d50c8812c59ee20399431a2d

SHA256
686699d59606cd7d2253dff2c92003380361f00b168305e959e66bab9bc725c0

SHA512
8bdce037441eb0ed6aa5fdf7569580b32dd5294b6b4a36a054552e5b46fcbba328b659f2277d3a75d23d9ead64a28d3db2fe49c0b1c13e6d799490ce6509ab1b

Download Submit
memory/2072-134-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2072-146-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5080-140-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/5080-147-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/5080-148-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download