Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20231129-en
  • resource tags

    arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system
  • submitted
    11/12/2023, 23:27

General

  • Target

    3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.exe

  • Size

    7.6MB

  • MD5

    21f8f09df645fe6d8266e32b42983080

  • SHA1

    6f73a2d809738c71706dbfd92456ad563e05f43e

  • SHA256

    3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1

  • SHA512

    35aec72a84d5d532aae3b69a8e2fc5da7f005d9545df05410556228355099cf8d98d35851ff1c21145cc85653cf20df6500ac26b68485e2c5b4ef49299e3b0ac

  • SSDEEP

    196608:fnnY8NWvGpWTTlm0OxwW+nFnfZsMUdFt30Dzj:fnnY8NELTIrxwlxQWDzj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 63 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.exe
    "C:\Users\Admin\AppData\Local\Temp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3600
    • C:\Users\Admin\AppData\Local\Temp\is-02FKI.tmp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-02FKI.tmp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp" /SL5="$60188,7715663,68096,C:\Users\Admin\AppData\Local\Temp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3284
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:4112
        • C:\Program Files (x86)\PlayGIF\gifplayer.exe
          "C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i
          3⤵
          • Executes dropped EXE
          PID:1108
        • C:\Program Files (x86)\PlayGIF\gifplayer.exe
          "C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s
          3⤵
          • Executes dropped EXE
          PID:2404
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" helpmsg 11
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5108
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 helpmsg 11
            4⤵
              PID:876

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\PlayGIF\gifplayer.exe

        Filesize

        970KB

        MD5

        b3af7e960026b31827e298c4e5514480

        SHA1

        6c9403d5de419780707c798e16f93ce698009bde

        SHA256

        a27b94673bff5a891ae159aa7d21de18f98fd42eecf8482a7879c43d094c965e

        SHA512

        def1ec4d3745bcfca308acc15c21b764cf877bcb7607b499fcce7a0e45523f1d404465522ef527311ff895c4869ac409c1627e9b9575805a2c57383423fe9f8a

      • C:\Program Files (x86)\PlayGIF\gifplayer.exe

        Filesize

        851KB

        MD5

        4ea6b12e7ff65045f8dfa55f1ec4bf71

        SHA1

        49e9f07bb33d921c1f78d7a640118ecbf0c63980

        SHA256

        a2ddb4617ffbeec2140e943b9f7dbb3f4645971b86c59b5c1ec01b71a4f98b8d

        SHA512

        afe72a42b2bd160f7f1a1603d0a1843e46ade40df7af6ed2d33b077ff50238b9bdea9f1e0e7791126337a9b87499eac720fc81dcb2b7feb81fab3edb14a8078c

      • C:\Program Files (x86)\PlayGIF\gifplayer.exe

        Filesize

        816KB

        MD5

        31bda5c86e5781b9e0a8f36014481fc9

        SHA1

        c38c7b05551d698504f3f0eb971af04e897b5079

        SHA256

        394de657e5d80462bcc6e75f4438ac185b2b6e1f575f7a7f4ac9d3c4f5458892

        SHA512

        17c7446c9f11f597078aaae1dd8100e2b41e58b118a64cbbc86325aed53ff2eb096c16beaffeabf311378d50e756f599ced3348ee36628c1eaa1bb9801b496c5

      • C:\Users\Admin\AppData\Local\Temp\is-02FKI.tmp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp

        Filesize

        444KB

        MD5

        1502ea7e29989eb930df6e9c135fe1a4

        SHA1

        c443aec51251ee642d8cc6aa9f8291b71c645186

        SHA256

        0805d4989664a4aaaa3cd446a04a09a103619c39349e1a8f06e9cab22c613f7d

        SHA512

        50b85936d04dc971d4bf1a898faea4d73f88d566631063c72137dd065a2ac7231bdf4756403b3864e0b0afe9e3f922862e72db0b9ddad908bb0a48ca62952bfb

      • C:\Users\Admin\AppData\Local\Temp\is-02FKI.tmp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp

        Filesize

        412KB

        MD5

        5bb6216ca71740697ca565c5aa72f7a1

        SHA1

        d55ba5e15c175cc7394ed6eb708f907792f5f21a

        SHA256

        2c0490b7aac90f39c8a3c3e56b77baac43f33b3117b94d563374f354d415786d

        SHA512

        deb46475d4896735bb8106e29cefeb8054528234b5b3d958ee44e0904829ebf31e0b0ab9ea929c7a6e481107b89f60dde28c9dd3572cd8614425dfc544b6694a

      • \Users\Admin\AppData\Local\Temp\is-DGVNU.tmp\_isetup\_iscrypt.dll

        Filesize

        2KB

        MD5

        a69559718ab506675e907fe49deb71e9

        SHA1

        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

        SHA256

        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

        SHA512

        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

      • \Users\Admin\AppData\Local\Temp\is-DGVNU.tmp\_isetup\_isdecmp.dll

        Filesize

        19KB

        MD5

        3adaa386b671c2df3bae5b39dc093008

        SHA1

        067cf95fbdb922d81db58432c46930f86d23dded

        SHA256

        71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

        SHA512

        bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

      • memory/1108-152-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/1108-154-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/1108-151-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/2404-160-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/2404-187-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/2404-206-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/2404-157-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/2404-203-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/2404-200-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/2404-197-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/2404-194-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/2404-164-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/2404-165-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/2404-168-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/2404-171-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/2404-174-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/2404-177-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/2404-179-0x0000000000830000-0x00000000008CE000-memory.dmp

        Filesize

        632KB

      • memory/2404-184-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/2404-191-0x0000000000400000-0x000000000068F000-memory.dmp

        Filesize

        2.6MB

      • memory/2404-188-0x0000000000830000-0x00000000008CE000-memory.dmp

        Filesize

        632KB

      • memory/3284-13-0x00000000001F0000-0x00000000001F1000-memory.dmp

        Filesize

        4KB

      • memory/3284-161-0x00000000001F0000-0x00000000001F1000-memory.dmp

        Filesize

        4KB

      • memory/3284-159-0x0000000000400000-0x00000000004BC000-memory.dmp

        Filesize

        752KB

      • memory/3600-0-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/3600-158-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/3600-2-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB