Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
11/10/2023, 18:44
General
-
Target
WebCompanion-Installer.exe
-
Size
564KB
-
MD5
0cf288864d5b601973dc7eefb4a7a60e
-
SHA1
78431b8ee6681dc6c565c40ad105930596851b00
-
SHA256
80fbddda7254e54b0dc198a91993219cfacbb2edeafd1040e0cf528c38720c1f
-
SHA512
be2aa021a0fc66350b907401682770b9862a6c81ce25246bee18b26416ff88a0cd76b7f7ad9a6d78e2003da52403840289671f918cc0819797f63d29376ff4a4
-
SSDEEP
12288:lG5knZfFKeUF3139E8i55DzYxLMvjtmosWyy9:lG50ZfFKNp1REdzYxQMobyy9
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WebCompanion-Installer.exe"C:\Users\Admin\AppData\Local\Temp\WebCompanion-Installer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC176E0C7\WebCompanion-Installer.exe.\WebCompanion-Installer.exe --partner=newwebsite --version=11.7.0.8072⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
428KB
MD51350eb96db6e954175788f6db66780b9
SHA12ca2c06d58119cd9b06ca58a4bf0ee3213d26a37
SHA2568ec3529b095fa85e57b374774da1ce11fe39e600101edf1b4646e351cb86d522
SHA512a6e00ed2b5f90bd6c2a1a697531dd9264e3112f4660d5a878859b1beb522d170011de40bbe00bb6df28b5c1aabacbb20215500fb4b39fca2eeb9f17b141b9d9b
-
Filesize
428KB
MD51350eb96db6e954175788f6db66780b9
SHA12ca2c06d58119cd9b06ca58a4bf0ee3213d26a37
SHA2568ec3529b095fa85e57b374774da1ce11fe39e600101edf1b4646e351cb86d522
SHA512a6e00ed2b5f90bd6c2a1a697531dd9264e3112f4660d5a878859b1beb522d170011de40bbe00bb6df28b5c1aabacbb20215500fb4b39fca2eeb9f17b141b9d9b
-
Filesize
428KB
MD51350eb96db6e954175788f6db66780b9
SHA12ca2c06d58119cd9b06ca58a4bf0ee3213d26a37
SHA2568ec3529b095fa85e57b374774da1ce11fe39e600101edf1b4646e351cb86d522
SHA512a6e00ed2b5f90bd6c2a1a697531dd9264e3112f4660d5a878859b1beb522d170011de40bbe00bb6df28b5c1aabacbb20215500fb4b39fca2eeb9f17b141b9d9b
-
Filesize
489KB
MD5d44648c4befb008c0306a30664a7c2f9
SHA16665cb33cec43a7cab638cc1029c481fcf7faf84
SHA256bae163d73316a1d300aaaa3effaed880796656d24ebdbe117baade90635060e7
SHA512d309206c704e7b06c4305a8f3beddc552c789e808b020dec6ed63fa2ec4ced433988d0ac5301fa30a9f08fd4c43816d6069d33d3e1b329714904bb0cf713bb0d
-
Filesize
489KB
MD5d44648c4befb008c0306a30664a7c2f9
SHA16665cb33cec43a7cab638cc1029c481fcf7faf84
SHA256bae163d73316a1d300aaaa3effaed880796656d24ebdbe117baade90635060e7
SHA512d309206c704e7b06c4305a8f3beddc552c789e808b020dec6ed63fa2ec4ced433988d0ac5301fa30a9f08fd4c43816d6069d33d3e1b329714904bb0cf713bb0d
-
Filesize
2KB
MD564abd91889ce8de4bc8c29317808d6f4
SHA1178e66a60fd7d39973081192302e1410f0bb9827
SHA2567dfa0da7b4d15c615dd5d905968a31270904585cda8974ee49e4d2ac93f1dec1
SHA512832d0bcc6aeada9890c975720098b9a9947f3d82fbd1a5fe9073133c0ea6356b04ba136312032ab86b41ae5bcea9f01373cf99fe04f9c787de313abe2c798044
-
Filesize
9KB
MD513540befc0ca1d490bad445719983a34
SHA1aca3b69b051a615d39f7f9376e1e7a05d0ccc6af
SHA25612a59c2cc60dd9c80ab9af9893503bcf72e9d9fc070d87cd2d00de111db1472d
SHA5120653632e8725e6b70af1474d4bdbebc58e93060842307df8b256038481bb75ae0508cfda25b103831100ae535d8a6d5755a6f2803964340b359c73687014b624
-
Filesize
9KB
MD513540befc0ca1d490bad445719983a34
SHA1aca3b69b051a615d39f7f9376e1e7a05d0ccc6af
SHA25612a59c2cc60dd9c80ab9af9893503bcf72e9d9fc070d87cd2d00de111db1472d
SHA5120653632e8725e6b70af1474d4bdbebc58e93060842307df8b256038481bb75ae0508cfda25b103831100ae535d8a6d5755a6f2803964340b359c73687014b624
-
Filesize
9KB
MD513540befc0ca1d490bad445719983a34
SHA1aca3b69b051a615d39f7f9376e1e7a05d0ccc6af
SHA25612a59c2cc60dd9c80ab9af9893503bcf72e9d9fc070d87cd2d00de111db1472d
SHA5120653632e8725e6b70af1474d4bdbebc58e93060842307df8b256038481bb75ae0508cfda25b103831100ae535d8a6d5755a6f2803964340b359c73687014b624
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
440KB
-
Filesize
320KB
-
Filesize
6.1MB
-
Filesize
128KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
496KB
-
Filesize
7.7MB
-
Filesize
64KB