Analysis

  • max time kernel
    140s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2023, 13:48

General

  • Target

    34caf36645a8c7becb98e64af108eb1691a952cc2efc57a55e90530bd52a858c.exe

  • Size

    3.3MB

  • MD5

    f96e3442a8699d9014a31091484b44d4

  • SHA1

    6d1a74404dde4bf2cb352164df93d5a2ddf12386

  • SHA256

    34caf36645a8c7becb98e64af108eb1691a952cc2efc57a55e90530bd52a858c

  • SHA512

    02ad199440d259a98e9892ac43825c745a142421afde951a95c70ec435e9a6df321e4d12a6ea36f981f35eec2e4e34abc38746ea6e26109de3e32e725c82da94

  • SSDEEP

    49152:/zeqaA8fG9XnjS6OnXds7aMdc1otuL8wRswq8LxS2TLJ9f8KywtrE3NYUxGC5BU7:b5gUVOXdP+c1EuzPLxNJywtgdExIUk0

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\34caf36645a8c7becb98e64af108eb1691a952cc2efc57a55e90530bd52a858c.exe
    "C:\Users\Admin\AppData\Local\Temp\34caf36645a8c7becb98e64af108eb1691a952cc2efc57a55e90530bd52a858c.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2608
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Windows\SysWOW64\MSIEXEC.EXE
        MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msrdpcli.msi"
        3⤵
        • Enumerates connected drives
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2768
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Setup.INI

    Filesize

    56KB

    MD5

    10d0937f0034d610f5ceaec5423597dc

    SHA1

    4202c6f7aaa76c2e7e3c45e649097d38a28f2b02

    SHA256

    ab79c60cab3866812bb67d0b0116e0af4b6a6e7b673bd7572df563d5a961d632

    SHA512

    58505fa2896828090c068ea7328610c6e733ae0fb94c1f79631c1afcdf5c7f52131d98a3c4b62ee087ea5d9c6a9977afb756e179cb9abe02d61a9a81dec37f24

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msrdpcli.msi

    Filesize

    751KB

    MD5

    13fb585d7981d700fba8fb61c3584a72

    SHA1

    b6136fbe483351a887e5fff0671ff184fa4543ee

    SHA256

    792d59d9a0706193b291b4bab0e2ac9da12603062f67568228d381622367710b

    SHA512

    269a7a3917fbf55e090311e4422ad8735358e1516adb5622ad1793e9bbc68679cd09945037cf09be8410f140d6c833e392e29c44817e17420d0dff3222a06acd

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe

    Filesize

    84KB

    MD5

    b8edf8d30608ec72839a0289d67cc919

    SHA1

    01f8d8fa1f6ca7b1e452b5410e1c1596c914076f

    SHA256

    de13730ef8f6614d99387ef8a3fd81d5f6127c9ea8bfa776783abe9f4eff2281

    SHA512

    f68329fa65dd74249c8d157511f94db769a55a7db8045e89bb4ed9e7f2b3e662e0bd5de0beb392d744d3b468783ac342ddfdbe14839bf8a2ca5b0b2c5ec5b6e0

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe

    Filesize

    84KB

    MD5

    b8edf8d30608ec72839a0289d67cc919

    SHA1

    01f8d8fa1f6ca7b1e452b5410e1c1596c914076f

    SHA256

    de13730ef8f6614d99387ef8a3fd81d5f6127c9ea8bfa776783abe9f4eff2281

    SHA512

    f68329fa65dd74249c8d157511f94db769a55a7db8045e89bb4ed9e7f2b3e662e0bd5de0beb392d744d3b468783ac342ddfdbe14839bf8a2ca5b0b2c5ec5b6e0

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe

    Filesize

    84KB

    MD5

    b8edf8d30608ec72839a0289d67cc919

    SHA1

    01f8d8fa1f6ca7b1e452b5410e1c1596c914076f

    SHA256

    de13730ef8f6614d99387ef8a3fd81d5f6127c9ea8bfa776783abe9f4eff2281

    SHA512

    f68329fa65dd74249c8d157511f94db769a55a7db8045e89bb4ed9e7f2b3e662e0bd5de0beb392d744d3b468783ac342ddfdbe14839bf8a2ca5b0b2c5ec5b6e0

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe

    Filesize

    84KB

    MD5

    b8edf8d30608ec72839a0289d67cc919

    SHA1

    01f8d8fa1f6ca7b1e452b5410e1c1596c914076f

    SHA256

    de13730ef8f6614d99387ef8a3fd81d5f6127c9ea8bfa776783abe9f4eff2281

    SHA512

    f68329fa65dd74249c8d157511f94db769a55a7db8045e89bb4ed9e7f2b3e662e0bd5de0beb392d744d3b468783ac342ddfdbe14839bf8a2ca5b0b2c5ec5b6e0

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe

    Filesize

    84KB

    MD5

    b8edf8d30608ec72839a0289d67cc919

    SHA1

    01f8d8fa1f6ca7b1e452b5410e1c1596c914076f

    SHA256

    de13730ef8f6614d99387ef8a3fd81d5f6127c9ea8bfa776783abe9f4eff2281

    SHA512

    f68329fa65dd74249c8d157511f94db769a55a7db8045e89bb4ed9e7f2b3e662e0bd5de0beb392d744d3b468783ac342ddfdbe14839bf8a2ca5b0b2c5ec5b6e0

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe

    Filesize

    84KB

    MD5

    b8edf8d30608ec72839a0289d67cc919

    SHA1

    01f8d8fa1f6ca7b1e452b5410e1c1596c914076f

    SHA256

    de13730ef8f6614d99387ef8a3fd81d5f6127c9ea8bfa776783abe9f4eff2281

    SHA512

    f68329fa65dd74249c8d157511f94db769a55a7db8045e89bb4ed9e7f2b3e662e0bd5de0beb392d744d3b468783ac342ddfdbe14839bf8a2ca5b0b2c5ec5b6e0