Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-10-2023 17:01

General

  • Target

    b0f91c6deb931938b07efe82d94c6a5f1a4c02e88aa363510173d8e03b5693c3.exe

  • Size

    10.5MB

  • MD5

    72779104658603b444660521a7bebe06

  • SHA1

    8fe0abe063e9311f3bf71ece6e5a727e7e122e70

  • SHA256

    b0f91c6deb931938b07efe82d94c6a5f1a4c02e88aa363510173d8e03b5693c3

  • SHA512

    8e4d34cd96f4011ca463852eefa9767f53ea5e32146d78695e9e5fceb3a03da82382359898c27bffababfe8a1b6c41fade78e4bbf6a88877e26529708a058f73

  • SSDEEP

    196608:SBBZMk+TOfMUEGxWMLoXSTbISqh3arecbxn5o6Lb8McYLWa32/tjbk0Kw/lCt1yg:SBBl+TdUETMTY7h3UbxnT04KaG/tjw0M

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b0f91c6deb931938b07efe82d94c6a5f1a4c02e88aa363510173d8e03b5693c3.exe
    "C:\Users\Admin\AppData\Local\Temp\b0f91c6deb931938b07efe82d94c6a5f1a4c02e88aa363510173d8e03b5693c3.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4420
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c del "C:\Users\Admin\AppData\Local\Temp\*91c6deb931938b07efe82d94c6a5f1a4c02e88aa363510173d8e03b5693c3.exe"
      2⤵
        PID:3796
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c del "C:\Users\Admin\AppData\Local\Temp\*.dll"
        2⤵
          PID:3888

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\64c4f4597732a7b59a32def9beea80cb.ini

        Filesize

        1KB

        MD5

        6ec353517ee53a36ab4300b3f2c81502

        SHA1

        d4c6dac2a8d688a7b0053e72174365beb786e646

        SHA256

        bfe01ab3783a802b7f55356d45f0d37519428de273213f41e93bdcfdd64e0f08

        SHA512

        0bac896294d3fa390ce5f34724ca6e12b6b8a5ff984d3b8f59ef5a1aae7e1e117e1a1708162b8c06f85fd4975f11c218ffeef15a18ec244d01bec6f8bde7d3f7

      • C:\Users\Admin\AppData\Local\Temp\64c4f4597732a7b59a32def9beea80cbA.ini

        Filesize

        1KB

        MD5

        c0d7496332120d41a7e02d3411d9c5dc

        SHA1

        e6ba7a30c5f3f86b57f48e61cfec77861492f223

        SHA256

        538e316246ac4dbba92b1e7af7d195c67e5cdb096ead70f5a795450bfafdab7c

        SHA512

        31f720082fa8c66e04f3ef833acd8073c75ae98ba6ce6eae81b22c422c2fff673a39b9963cc65d9e8ddb144d261c0fcb87ae826979cc28044abda6be9658ef08

      • C:\Users\Admin\AppData\Local\Temp\b0f91c6deb931938b07efe82d94c6a5f1a4c02e88aa363510173d8e03b5693c3.exepack.tmp

        Filesize

        2KB

        MD5

        2da3deba5f134c4fffcd557789ff42fe

        SHA1

        eb96ba3ea478e84251b18f0ad77181938075edde

        SHA256

        62056286fbe574327b8fe2b0b899e73b9c155e7af5899ed41acf5550843625f8

        SHA512

        f66988b6be82ada5f27652bed6a807ceea5ba9b1cc57f8e821cd2f912db3ecb99c461d74ca943b29ef0e1b79b0d3f559c5c45047de6d9a399517bff43631574b

      • memory/4420-0-0x0000000000400000-0x0000000001EED000-memory.dmp

        Filesize

        26.9MB

      • memory/4420-1-0x00000000024C0000-0x00000000024C3000-memory.dmp

        Filesize

        12KB

      • memory/4420-2-0x0000000000400000-0x0000000001EED000-memory.dmp

        Filesize

        26.9MB

      • memory/4420-5-0x0000000050000000-0x0000000050109000-memory.dmp

        Filesize

        1.0MB

      • memory/4420-339-0x0000000000400000-0x0000000001EED000-memory.dmp

        Filesize

        26.9MB

      • memory/4420-340-0x00000000024C0000-0x00000000024C3000-memory.dmp

        Filesize

        12KB

      • memory/4420-341-0x0000000050000000-0x0000000050109000-memory.dmp

        Filesize

        1.0MB

      • memory/4420-342-0x0000000000400000-0x0000000001EED000-memory.dmp

        Filesize

        26.9MB

      • memory/4420-351-0x0000000000400000-0x0000000001EED000-memory.dmp

        Filesize

        26.9MB