4423693e8b8a26a3096c64522b0eb2d8b24845f1737ad98879cdc301c8f5ed01

Analysis

max time kernel
240s
max time network
276s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
28-09-2023 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PREREQUISITES/Silverlight_x64.exe
Size

12.6MB
MD5

4dde36bf591d7aa0b05497afd40ac2cc
SHA1

ad8db31020463e825c0b620d93477b5321c072d8
SHA256

8d263a6f42a378073b6f057f242a42076f9f4082340153c2e27ecc959c5036aa
SHA512

7a525b78e803a816fa653f4afabde625dd430294fbaac387408591e3c65a122c8c2de1fd65ceaa4e16b44eba97afdf90b233f4e4e169f204c029586f28f45e20
SSDEEP

393216:YwpygvheTgJ/+wP8Ut8ufz/XaAuJdWFJ3+bl:Jsgv4w8U6U/KNzWqbl

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

install.exe

pid process

2924 install.exe
1200
Loads dropped DLL 3 IoCs

Processes:

Silverlight_x64.exeinstall.exe

pid process

2524 Silverlight_x64.exe
2924 install.exe
2924 install.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

install.exe

pid process

2924 install.exe

pid	process
2924	install.exe
1200

pid	process
2524	Silverlight_x64.exe
2924	install.exe
2924	install.exe

pid	process
2924	install.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Silverlight_x64.exe

description	pid	process	target process
PID 2524 wrote to memory of 2924	2524	Silverlight_x64.exe	install.exe
PID 2524 wrote to memory of 2924	2524	Silverlight_x64.exe	install.exe
PID 2524 wrote to memory of 2924	2524	Silverlight_x64.exe	install.exe
PID 2524 wrote to memory of 2924	2524	Silverlight_x64.exe	install.exe
PID 2524 wrote to memory of 2924	2524	Silverlight_x64.exe	install.exe
PID 2524 wrote to memory of 2924	2524	Silverlight_x64.exe	install.exe
PID 2524 wrote to memory of 2924	2524	Silverlight_x64.exe	install.exe

C:\Users\Admin\AppData\Local\Temp\PREREQUISITES\Silverlight_x64.exe
"C:\Users\Admin\AppData\Local\Temp\PREREQUISITES\Silverlight_x64.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524

\??\c:\f42fd27e6aad05af35dbfe7d31\install.exe
c:\f42fd27e6aad05af35dbfe7d31\install.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\f42fd27e6aad05af35dbfe7d31\install.exe

Filesize
282KB

MD5
df0d5d37c2a2225148579486fa7043b7

SHA1
33a7d00a17f2cc9d78a48b927b5c23bb368b6097

SHA256
963f37570fee71bd9e86f592f86c898729446e2d18fa1f08d236b3f9cc4d31f3

SHA512
8218dccd60b47a9313d3642e89b1aa956183c0b9e7c8d1a4e5556c1804e009e839cae60cc5e2bbe7cfd62ccbe935bd0e683fff25ecd0a0571bc6df8c2295d7cb

Download Submit
\??\c:\f42fd27e6aad05af35dbfe7d31\install.exe

Filesize
282KB

MD5
df0d5d37c2a2225148579486fa7043b7

SHA1
33a7d00a17f2cc9d78a48b927b5c23bb368b6097

SHA256
963f37570fee71bd9e86f592f86c898729446e2d18fa1f08d236b3f9cc4d31f3

SHA512
8218dccd60b47a9313d3642e89b1aa956183c0b9e7c8d1a4e5556c1804e009e839cae60cc5e2bbe7cfd62ccbe935bd0e683fff25ecd0a0571bc6df8c2295d7cb

Download Submit
\??\c:\f42fd27e6aad05af35dbfe7d31\install.res.dll

Filesize
428KB

MD5
6a1bb0fa3a7ee1d0ed1291cb168e38f2

SHA1
28446ba2127050d1bd4ef635eaa106853fbfc74c

SHA256
a7a5283f564a2108a24f6180aae90d3800f7d49872a284c2ac9f8daa15bd33df

SHA512
eb8b1d88d07e079838a8b1aae7e4ddf6b3394cd8c5375541eeabd3a775a9eb451a26bca23aa8fe68b0c47e759075131c5b86181ff3f1d537a1a32c9ddc0373ab

Download Submit
\f42fd27e6aad05af35dbfe7d31\install.exe

Filesize
282KB

MD5
df0d5d37c2a2225148579486fa7043b7

SHA1
33a7d00a17f2cc9d78a48b927b5c23bb368b6097

SHA256
963f37570fee71bd9e86f592f86c898729446e2d18fa1f08d236b3f9cc4d31f3

SHA512
8218dccd60b47a9313d3642e89b1aa956183c0b9e7c8d1a4e5556c1804e009e839cae60cc5e2bbe7cfd62ccbe935bd0e683fff25ecd0a0571bc6df8c2295d7cb

Download Submit
\f42fd27e6aad05af35dbfe7d31\install.exe

Filesize
282KB

MD5
df0d5d37c2a2225148579486fa7043b7

SHA1
33a7d00a17f2cc9d78a48b927b5c23bb368b6097

SHA256
963f37570fee71bd9e86f592f86c898729446e2d18fa1f08d236b3f9cc4d31f3

SHA512
8218dccd60b47a9313d3642e89b1aa956183c0b9e7c8d1a4e5556c1804e009e839cae60cc5e2bbe7cfd62ccbe935bd0e683fff25ecd0a0571bc6df8c2295d7cb

Download Submit
\f42fd27e6aad05af35dbfe7d31\install.exe

Filesize
282KB

MD5
df0d5d37c2a2225148579486fa7043b7

SHA1
33a7d00a17f2cc9d78a48b927b5c23bb368b6097

SHA256
963f37570fee71bd9e86f592f86c898729446e2d18fa1f08d236b3f9cc4d31f3

SHA512
8218dccd60b47a9313d3642e89b1aa956183c0b9e7c8d1a4e5556c1804e009e839cae60cc5e2bbe7cfd62ccbe935bd0e683fff25ecd0a0571bc6df8c2295d7cb

Download Submit
\f42fd27e6aad05af35dbfe7d31\install.res.dll

Filesize
428KB

MD5
6a1bb0fa3a7ee1d0ed1291cb168e38f2

SHA1
28446ba2127050d1bd4ef635eaa106853fbfc74c

SHA256
a7a5283f564a2108a24f6180aae90d3800f7d49872a284c2ac9f8daa15bd33df

SHA512
eb8b1d88d07e079838a8b1aae7e4ddf6b3394cd8c5375541eeabd3a775a9eb451a26bca23aa8fe68b0c47e759075131c5b86181ff3f1d537a1a32c9ddc0373ab

Download Submit
memory/2924-13-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2924-15-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download