Analysis
-
max time kernel
142s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01-12-2023 02:30
Static task
static1
Behavioral task
behavioral1
Sample
Setup_DriverDoc_2024.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Setup_DriverDoc_2024.exe
Resource
win10v2004-20231127-en
General
-
Target
Setup_DriverDoc_2024.exe
-
Size
6.0MB
-
MD5
c65a354ac28f2f45c7ca8a38e4f778d6
-
SHA1
42d84f6be5cfa1503dc7bd8275073872d71a4fc0
-
SHA256
396cb9e17c57f09c4afab97f91e72011e3f115b15e764c39d26473d92fe2c45e
-
SHA512
7acba2651fb1378a97c47ce6723808235ddd74d2cb736f5fb6f28a241f3b33188e9a511c6be2eb3ca8e7cad68c05a76a0c853edc5a417a16aacd5c0388950017
-
SSDEEP
98304:KSi1jH0UJukUYMwioEgGU9KM+ZFNIO05p0oO2gz8+fyTx:MUvkUMiij9KM+7Npc0R4+KTx
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Setup_DriverDoc_2024.tmppid process 2308 Setup_DriverDoc_2024.tmp -
Loads dropped DLL 1 IoCs
Processes:
Setup_DriverDoc_2024.exepid process 1564 Setup_DriverDoc_2024.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Setup_DriverDoc_2024.tmppid process 2308 Setup_DriverDoc_2024.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
Setup_DriverDoc_2024.exedescription pid process target process PID 1564 wrote to memory of 2308 1564 Setup_DriverDoc_2024.exe Setup_DriverDoc_2024.tmp PID 1564 wrote to memory of 2308 1564 Setup_DriverDoc_2024.exe Setup_DriverDoc_2024.tmp PID 1564 wrote to memory of 2308 1564 Setup_DriverDoc_2024.exe Setup_DriverDoc_2024.tmp PID 1564 wrote to memory of 2308 1564 Setup_DriverDoc_2024.exe Setup_DriverDoc_2024.tmp PID 1564 wrote to memory of 2308 1564 Setup_DriverDoc_2024.exe Setup_DriverDoc_2024.tmp PID 1564 wrote to memory of 2308 1564 Setup_DriverDoc_2024.exe Setup_DriverDoc_2024.tmp PID 1564 wrote to memory of 2308 1564 Setup_DriverDoc_2024.exe Setup_DriverDoc_2024.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup_DriverDoc_2024.exe"C:\Users\Admin\AppData\Local\Temp\Setup_DriverDoc_2024.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\is-09U49.tmp\Setup_DriverDoc_2024.tmp"C:\Users\Admin\AppData\Local\Temp\is-09U49.tmp\Setup_DriverDoc_2024.tmp" /SL5="$40108,5347251,879104,C:\Users\Admin\AppData\Local\Temp\Setup_DriverDoc_2024.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2308
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5d70a98daf7a810ee18ce451ec673e399
SHA1274dff37313f3fbdf82dfc4afd94582359b79fee
SHA2569621346beee2a257b1966b6dc3f1f850d54ae0746bf1718d35c966649ac9b340
SHA512a246aa8979a7bc1a8ae6d1c5ac637939e7ab3380484cb78a3fc98fe9ceccb51cb5d6dfe787ece6bb1420450741c0734a049849dac7242679b8660e71acf00e60
-
Filesize
3.1MB
MD5d70a98daf7a810ee18ce451ec673e399
SHA1274dff37313f3fbdf82dfc4afd94582359b79fee
SHA2569621346beee2a257b1966b6dc3f1f850d54ae0746bf1718d35c966649ac9b340
SHA512a246aa8979a7bc1a8ae6d1c5ac637939e7ab3380484cb78a3fc98fe9ceccb51cb5d6dfe787ece6bb1420450741c0734a049849dac7242679b8660e71acf00e60