Analysis

  • max time kernel
    146s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 10:24

General

  • Target

    57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe

  • Size

    2.8MB

  • MD5

    a59c5cfff822ca337569eb73f9b33d02

  • SHA1

    5df611f1f8e328c14c10ccd80818cc6d80891256

  • SHA256

    57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f

  • SHA512

    b021a1832f90b3a4d8e8187d2d9e5d6bdb8661cd9c4eab67248cf8f3c9a9a012b79b255eec38eb16a3675792bfd3026ffd9a5b8071f3d9bfac6c40ad76858861

  • SSDEEP

    49152:zGFjrscUfO7otry1+K0ZLLyVvP1B94iJqoP8tsUM05:qFjrwfxZd2lBFjysUd5

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs net.exe
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe
    "C:\Users\Admin\AppData\Local\Temp\57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Users\Admin\AppData\Local\Temp\is-VQV34.tmp\is-4VB40.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-VQV34.tmp\is-4VB40.tmp" /SL4 $70122 "C:\Users\Admin\AppData\Local\Temp\57d965820c0afad2617da9bf308739da512230d53d06072c9a761c2048b5826f.exe" 2672038 52224
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\system32\net.exe" helpmsg 27
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2512
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 helpmsg 27
          4⤵
            PID:2564
        • C:\Program Files (x86)\OSJMount\OSJMount.exe
          "C:\Program Files (x86)\OSJMount\OSJMount.exe" -i
          3⤵
          • Executes dropped EXE
          PID:2600
        • C:\Program Files (x86)\OSJMount\OSJMount.exe
          "C:\Program Files (x86)\OSJMount\OSJMount.exe" -s
          3⤵
          • Executes dropped EXE
          PID:2984

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\OSJMount\OSJMount.exe

      Filesize

      2.0MB

      MD5

      5912bbcdfa36233362763a4060ced585

      SHA1

      55be4167661d442b499ed9c5859b20b03538a348

      SHA256

      6a2ae59fd216c959c32afd32c291b5127a820ad50f46df15985d7b9e3d1ef1c6

      SHA512

      c6e50d0003dcdd16c815861053279067da0bb5dc9f6b7430c3eb0a7865d5b5416de295e83c2c0a1c862c7d6f956ca37c99db030fff092dec32d8974120969e86

    • C:\Program Files (x86)\OSJMount\OSJMount.exe

      Filesize

      2.0MB

      MD5

      5912bbcdfa36233362763a4060ced585

      SHA1

      55be4167661d442b499ed9c5859b20b03538a348

      SHA256

      6a2ae59fd216c959c32afd32c291b5127a820ad50f46df15985d7b9e3d1ef1c6

      SHA512

      c6e50d0003dcdd16c815861053279067da0bb5dc9f6b7430c3eb0a7865d5b5416de295e83c2c0a1c862c7d6f956ca37c99db030fff092dec32d8974120969e86

    • C:\Program Files (x86)\OSJMount\OSJMount.exe

      Filesize

      2.0MB

      MD5

      5912bbcdfa36233362763a4060ced585

      SHA1

      55be4167661d442b499ed9c5859b20b03538a348

      SHA256

      6a2ae59fd216c959c32afd32c291b5127a820ad50f46df15985d7b9e3d1ef1c6

      SHA512

      c6e50d0003dcdd16c815861053279067da0bb5dc9f6b7430c3eb0a7865d5b5416de295e83c2c0a1c862c7d6f956ca37c99db030fff092dec32d8974120969e86

    • C:\Users\Admin\AppData\Local\Temp\is-VQV34.tmp\is-4VB40.tmp

      Filesize

      652KB

      MD5

      f1b5055e1e80bf52a48683f85f9298ef

      SHA1

      26976cc0c690693084466d185c5e84da9870a778

      SHA256

      0b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50

      SHA512

      01290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef

    • C:\Users\Admin\AppData\Local\Temp\is-VQV34.tmp\is-4VB40.tmp

      Filesize

      652KB

      MD5

      f1b5055e1e80bf52a48683f85f9298ef

      SHA1

      26976cc0c690693084466d185c5e84da9870a778

      SHA256

      0b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50

      SHA512

      01290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef

    • \Program Files (x86)\OSJMount\OSJMount.exe

      Filesize

      2.0MB

      MD5

      5912bbcdfa36233362763a4060ced585

      SHA1

      55be4167661d442b499ed9c5859b20b03538a348

      SHA256

      6a2ae59fd216c959c32afd32c291b5127a820ad50f46df15985d7b9e3d1ef1c6

      SHA512

      c6e50d0003dcdd16c815861053279067da0bb5dc9f6b7430c3eb0a7865d5b5416de295e83c2c0a1c862c7d6f956ca37c99db030fff092dec32d8974120969e86

    • \Users\Admin\AppData\Local\Temp\is-3F24D.tmp\_isetup\_iscrypt.dll

      Filesize

      2KB

      MD5

      a69559718ab506675e907fe49deb71e9

      SHA1

      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

      SHA256

      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

      SHA512

      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

    • \Users\Admin\AppData\Local\Temp\is-3F24D.tmp\_isetup\_shfoldr.dll

      Filesize

      22KB

      MD5

      92dc6ef532fbb4a5c3201469a5b5eb63

      SHA1

      3e89ff837147c16b4e41c30d6c796374e0b8e62c

      SHA256

      9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

      SHA512

      9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

    • \Users\Admin\AppData\Local\Temp\is-3F24D.tmp\_isetup\_shfoldr.dll

      Filesize

      22KB

      MD5

      92dc6ef532fbb4a5c3201469a5b5eb63

      SHA1

      3e89ff837147c16b4e41c30d6c796374e0b8e62c

      SHA256

      9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

      SHA512

      9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

    • \Users\Admin\AppData\Local\Temp\is-VQV34.tmp\is-4VB40.tmp

      Filesize

      652KB

      MD5

      f1b5055e1e80bf52a48683f85f9298ef

      SHA1

      26976cc0c690693084466d185c5e84da9870a778

      SHA256

      0b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50

      SHA512

      01290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef

    • memory/2228-20-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/2228-1-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/2600-50-0x0000000000400000-0x000000000060F000-memory.dmp

      Filesize

      2.1MB

    • memory/2600-45-0x0000000000400000-0x000000000060F000-memory.dmp

      Filesize

      2.1MB

    • memory/2600-43-0x0000000000400000-0x000000000060F000-memory.dmp

      Filesize

      2.1MB

    • memory/2600-47-0x0000000000400000-0x000000000060F000-memory.dmp

      Filesize

      2.1MB

    • memory/2764-21-0x0000000000400000-0x00000000004B2000-memory.dmp

      Filesize

      712KB

    • memory/2764-46-0x0000000003A70000-0x0000000003C7F000-memory.dmp

      Filesize

      2.1MB

    • memory/2764-44-0x0000000000400000-0x00000000004B2000-memory.dmp

      Filesize

      712KB

    • memory/2764-39-0x0000000003A70000-0x0000000003C7F000-memory.dmp

      Filesize

      2.1MB

    • memory/2764-22-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB

    • memory/2764-8-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB

    • memory/2984-67-0x0000000000400000-0x000000000060F000-memory.dmp

      Filesize

      2.1MB

    • memory/2984-79-0x0000000000400000-0x000000000060F000-memory.dmp

      Filesize

      2.1MB

    • memory/2984-64-0x0000000000400000-0x000000000060F000-memory.dmp

      Filesize

      2.1MB

    • memory/2984-53-0x0000000000400000-0x000000000060F000-memory.dmp

      Filesize

      2.1MB

    • memory/2984-70-0x0000000000400000-0x000000000060F000-memory.dmp

      Filesize

      2.1MB

    • memory/2984-73-0x0000000000400000-0x000000000060F000-memory.dmp

      Filesize

      2.1MB

    • memory/2984-76-0x0000000000400000-0x000000000060F000-memory.dmp

      Filesize

      2.1MB

    • memory/2984-56-0x0000000000400000-0x000000000060F000-memory.dmp

      Filesize

      2.1MB

    • memory/2984-80-0x0000000002780000-0x00000000027C9000-memory.dmp

      Filesize

      292KB

    • memory/2984-81-0x0000000002780000-0x00000000027C9000-memory.dmp

      Filesize

      292KB

    • memory/2984-87-0x0000000000400000-0x000000000060F000-memory.dmp

      Filesize

      2.1MB

    • memory/2984-88-0x0000000002780000-0x00000000027C9000-memory.dmp

      Filesize

      292KB

    • memory/2984-91-0x0000000000400000-0x000000000060F000-memory.dmp

      Filesize

      2.1MB

    • memory/2984-94-0x0000000000400000-0x000000000060F000-memory.dmp

      Filesize

      2.1MB