Analysis

  • max time kernel
    151s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2023, 03:20

General

  • Target

    fc49ee4702a7c9d95dfaea0a014e3ff6cc678baa96361159fc459f016dfcba9d.exe

  • Size

    370KB

  • MD5

    42578f059b473b2a62e141ab2a1a6ad4

  • SHA1

    20f774b65ab478e5c661f3cb321b4ade47d4c7ae

  • SHA256

    fc49ee4702a7c9d95dfaea0a014e3ff6cc678baa96361159fc459f016dfcba9d

  • SHA512

    c797307fa268f857769b1158ec23a702be0c9f470cc521f01874fab87525eaf3d3f5190514995d73611cecb94a416a24de31998904f160084211dadf1bd5bd48

  • SSDEEP

    6144:ZMp6t4DREcMZ5vVCiiKrao9afJu3YYtWGaVoRiS6hxH5AgPaxA:ZMp6+FuvVCiisao9Ii3aViKHye

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1264
      • C:\Users\Admin\AppData\Local\Temp\fc49ee4702a7c9d95dfaea0a014e3ff6cc678baa96361159fc459f016dfcba9d.exe
        "C:\Users\Admin\AppData\Local\Temp\fc49ee4702a7c9d95dfaea0a014e3ff6cc678baa96361159fc459f016dfcba9d.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2160
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2044
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:2588
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Users\Admin\AppData\Local\Temp\$$a5EB3.bat
            3⤵
            • Deletes itself
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2812
            • C:\Users\Admin\AppData\Local\Temp\fc49ee4702a7c9d95dfaea0a014e3ff6cc678baa96361159fc459f016dfcba9d.exe
              "C:\Users\Admin\AppData\Local\Temp\fc49ee4702a7c9d95dfaea0a014e3ff6cc678baa96361159fc459f016dfcba9d.exe"
              4⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of SetWindowsHookEx
              PID:2532
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2644
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2652
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:2708
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2964
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:1396

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

            Filesize

            258KB

            MD5

            45290af4beb107e9ebb9999a1ccfc37e

            SHA1

            bd6b220540c28369a94650f32b14113caa7a9ad1

            SHA256

            7c83414415b603bcc3ed8392831761f624af314c2a02c9fbce76975d249f6b78

            SHA512

            43eb9868b2ae38b874ae9613fd48cc3a9418b37f21b89372e0ed5d682a495c343dbf880b3f69edc3230de59fb7152bb368560506ada5fc861432d8efa9a92d10

          • C:\Users\Admin\AppData\Local\Temp\$$a5EB3.bat

            Filesize

            722B

            MD5

            c65f969a8cb4d36bac231cbf40b37c47

            SHA1

            210b5a184a906c0feab9e147374744b3adf92a0f

            SHA256

            63637c98e48382ae0334da6abf06a86db6a55ddc0610e5b62a3248819f9e7cc2

            SHA512

            14010e34e2ca69e31899c972133863c7986a105d9b7018d6db21333f3ed99be28b10ef718110669d4f7311fc78d22fb9eae807aa94037f6a3721312a3522e88a

          • C:\Users\Admin\AppData\Local\Temp\$$a5EB3.bat

            Filesize

            722B

            MD5

            c65f969a8cb4d36bac231cbf40b37c47

            SHA1

            210b5a184a906c0feab9e147374744b3adf92a0f

            SHA256

            63637c98e48382ae0334da6abf06a86db6a55ddc0610e5b62a3248819f9e7cc2

            SHA512

            14010e34e2ca69e31899c972133863c7986a105d9b7018d6db21333f3ed99be28b10ef718110669d4f7311fc78d22fb9eae807aa94037f6a3721312a3522e88a

          • C:\Users\Admin\AppData\Local\Temp\fc49ee4702a7c9d95dfaea0a014e3ff6cc678baa96361159fc459f016dfcba9d.exe

            Filesize

            337KB

            MD5

            383dcbf7e816408a7bcc0a2c41634356

            SHA1

            8179e5d4f88995a92110e4341be44335fa6636f6

            SHA256

            1a4bd956c34459258c85ca9c81dc547d2ef3e276c1f5d07f93902b4a8c74586e

            SHA512

            8b0b5015fc9100d58d73c1b331318f4568cf16529205b127c4ff473df95a8f0a52d5271cc4b66640630ed633449eccdf025166781b67834cc04d8ce23d79554a

          • C:\Users\Admin\AppData\Local\Temp\fc49ee4702a7c9d95dfaea0a014e3ff6cc678baa96361159fc459f016dfcba9d.exe.exe

            Filesize

            337KB

            MD5

            383dcbf7e816408a7bcc0a2c41634356

            SHA1

            8179e5d4f88995a92110e4341be44335fa6636f6

            SHA256

            1a4bd956c34459258c85ca9c81dc547d2ef3e276c1f5d07f93902b4a8c74586e

            SHA512

            8b0b5015fc9100d58d73c1b331318f4568cf16529205b127c4ff473df95a8f0a52d5271cc4b66640630ed633449eccdf025166781b67834cc04d8ce23d79554a

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            d4b910e72a18fa251db1ac00a3c27f62

            SHA1

            0fca93f82c67f8ee1fc564d47c3ed49b99c94222

            SHA256

            25d35297b7a17ad1411a81b7d3ac69808777adcd309bda2fdcc0fc300eda1dab

            SHA512

            42c49403938d951dcefc4eb4e04361c3f749517d07216c149efd1b2ec1f68e94e4b640c52e7c7bdcd5f06737bf988530acc71f79f568461d0549e09d92cfd521

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            d4b910e72a18fa251db1ac00a3c27f62

            SHA1

            0fca93f82c67f8ee1fc564d47c3ed49b99c94222

            SHA256

            25d35297b7a17ad1411a81b7d3ac69808777adcd309bda2fdcc0fc300eda1dab

            SHA512

            42c49403938d951dcefc4eb4e04361c3f749517d07216c149efd1b2ec1f68e94e4b640c52e7c7bdcd5f06737bf988530acc71f79f568461d0549e09d92cfd521

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            d4b910e72a18fa251db1ac00a3c27f62

            SHA1

            0fca93f82c67f8ee1fc564d47c3ed49b99c94222

            SHA256

            25d35297b7a17ad1411a81b7d3ac69808777adcd309bda2fdcc0fc300eda1dab

            SHA512

            42c49403938d951dcefc4eb4e04361c3f749517d07216c149efd1b2ec1f68e94e4b640c52e7c7bdcd5f06737bf988530acc71f79f568461d0549e09d92cfd521

          • C:\Windows\rundl132.exe

            Filesize

            33KB

            MD5

            d4b910e72a18fa251db1ac00a3c27f62

            SHA1

            0fca93f82c67f8ee1fc564d47c3ed49b99c94222

            SHA256

            25d35297b7a17ad1411a81b7d3ac69808777adcd309bda2fdcc0fc300eda1dab

            SHA512

            42c49403938d951dcefc4eb4e04361c3f749517d07216c149efd1b2ec1f68e94e4b640c52e7c7bdcd5f06737bf988530acc71f79f568461d0549e09d92cfd521

          • F:\$RECYCLE.BIN\S-1-5-21-607259312-1573743425-2763420908-1000\_desktop.ini

            Filesize

            10B

            MD5

            64a8745f77935c35c66f3aeeddf5d47d

            SHA1

            1214a584f661cb008b494ce6278289f8cf406810

            SHA256

            7841de37b0bf8c995d0b903bef18bd4159f94d9c2a35c91b06dabe8198c6c63a

            SHA512

            807b8f5512f868d0a2b1a10889164f787aa07b4309511326f4755d1121e666ec30dfb444a0565a5a7426cbd45b41d49d6429c9baf63a0bd3948b85b57841af3b

          • \Users\Admin\AppData\Local\Temp\fc49ee4702a7c9d95dfaea0a014e3ff6cc678baa96361159fc459f016dfcba9d.exe

            Filesize

            337KB

            MD5

            383dcbf7e816408a7bcc0a2c41634356

            SHA1

            8179e5d4f88995a92110e4341be44335fa6636f6

            SHA256

            1a4bd956c34459258c85ca9c81dc547d2ef3e276c1f5d07f93902b4a8c74586e

            SHA512

            8b0b5015fc9100d58d73c1b331318f4568cf16529205b127c4ff473df95a8f0a52d5271cc4b66640630ed633449eccdf025166781b67834cc04d8ce23d79554a

          • \Users\Admin\AppData\Local\Temp\fc49ee4702a7c9d95dfaea0a014e3ff6cc678baa96361159fc459f016dfcba9d.exe

            Filesize

            337KB

            MD5

            383dcbf7e816408a7bcc0a2c41634356

            SHA1

            8179e5d4f88995a92110e4341be44335fa6636f6

            SHA256

            1a4bd956c34459258c85ca9c81dc547d2ef3e276c1f5d07f93902b4a8c74586e

            SHA512

            8b0b5015fc9100d58d73c1b331318f4568cf16529205b127c4ff473df95a8f0a52d5271cc4b66640630ed633449eccdf025166781b67834cc04d8ce23d79554a

          • memory/1264-29-0x0000000002600000-0x0000000002601000-memory.dmp

            Filesize

            4KB

          • memory/2160-16-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2160-15-0x0000000000240000-0x000000000027D000-memory.dmp

            Filesize

            244KB

          • memory/2160-0-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2160-20-0x0000000000240000-0x000000000027D000-memory.dmp

            Filesize

            244KB

          • memory/2644-54-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2644-49-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2644-33-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2644-1470-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2644-2263-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2644-19-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2644-2278-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2644-2291-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2644-2340-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2644-2350-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2644-2911-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2644-2948-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB