Analysis

  • max time kernel
    66s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 22:59

General

  • Target

    17a45f069b06b773331c74553f1b4609.exe

  • Size

    329KB

  • MD5

    17a45f069b06b773331c74553f1b4609

  • SHA1

    ee7a076b0f6fb006df63d85f12d26616681e1229

  • SHA256

    22e70fa3a9da947966babc4af099e1f0517da5d59794c8037953644bb6c66f67

  • SHA512

    afcbc1405ec391a4632976df26a793f64e0ac8af8e763affe9148ebb6e60db895884350e299fddc349637276d763436ea153a1117e401df153e7b85876b3ae02

  • SSDEEP

    6144:rYwaU+TjJ56Qy/VfoUKIVflNiLoWtMn9QJTPPWZYbBt:0wP+PuQEfooiX+n9Q1nWZC

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17a45f069b06b773331c74553f1b4609.exe
    "C:\Users\Admin\AppData\Local\Temp\17a45f069b06b773331c74553f1b4609.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Modifies Internet Explorer settings
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpec04e090.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2432
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 112
        3⤵
        • Program crash
        • Suspicious use of WriteProcessMemory
        PID:1080
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 528
          4⤵
          • Program crash
          PID:1880
    • C:\Users\Admin\AppData\Roaming\Ifes\myowul.exe
      "C:\Users\Admin\AppData\Roaming\Ifes\myowul.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:3000
  • C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
    1⤵
      PID:1724
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1400
      • C:\Windows\system32\Dwm.exe
        "C:\Windows\system32\Dwm.exe"
        1⤵
          PID:1356
        • C:\Windows\system32\taskhost.exe
          "taskhost.exe"
          1⤵
            PID:1296
          • C:\Windows\system32\conhost.exe
            \??\C:\Windows\system32\conhost.exe "-11852257347719672571580179538-1616605547-202549628019061839221325566483-73563184"
            1⤵
              PID:1136

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1296-25-0x0000000002020000-0x0000000002064000-memory.dmp

              Filesize

              272KB

            • memory/1296-18-0x0000000002020000-0x0000000002064000-memory.dmp

              Filesize

              272KB

            • memory/1296-27-0x0000000002020000-0x0000000002064000-memory.dmp

              Filesize

              272KB

            • memory/1296-21-0x0000000002020000-0x0000000002064000-memory.dmp

              Filesize

              272KB

            • memory/1296-23-0x0000000002020000-0x0000000002064000-memory.dmp

              Filesize

              272KB

            • memory/1356-32-0x00000000001B0000-0x00000000001F4000-memory.dmp

              Filesize

              272KB

            • memory/1356-31-0x00000000001B0000-0x00000000001F4000-memory.dmp

              Filesize

              272KB

            • memory/1356-33-0x00000000001B0000-0x00000000001F4000-memory.dmp

              Filesize

              272KB

            • memory/1356-34-0x00000000001B0000-0x00000000001F4000-memory.dmp

              Filesize

              272KB

            • memory/1400-36-0x0000000002E40000-0x0000000002E84000-memory.dmp

              Filesize

              272KB

            • memory/1400-37-0x0000000002E40000-0x0000000002E84000-memory.dmp

              Filesize

              272KB

            • memory/1400-38-0x0000000002E40000-0x0000000002E84000-memory.dmp

              Filesize

              272KB

            • memory/1400-39-0x0000000002E40000-0x0000000002E84000-memory.dmp

              Filesize

              272KB

            • memory/1724-42-0x0000000000370000-0x00000000003B4000-memory.dmp

              Filesize

              272KB

            • memory/1724-48-0x0000000000370000-0x00000000003B4000-memory.dmp

              Filesize

              272KB

            • memory/1724-44-0x0000000000370000-0x00000000003B4000-memory.dmp

              Filesize

              272KB

            • memory/1724-46-0x0000000000370000-0x00000000003B4000-memory.dmp

              Filesize

              272KB

            • memory/2060-74-0x0000000000240000-0x0000000000241000-memory.dmp

              Filesize

              4KB

            • memory/2060-78-0x0000000000240000-0x0000000000241000-memory.dmp

              Filesize

              4KB

            • memory/2060-60-0x0000000000240000-0x0000000000241000-memory.dmp

              Filesize

              4KB

            • memory/2060-58-0x0000000000240000-0x0000000000241000-memory.dmp

              Filesize

              4KB

            • memory/2060-56-0x0000000000240000-0x0000000000241000-memory.dmp

              Filesize

              4KB

            • memory/2060-55-0x0000000000860000-0x00000000008A4000-memory.dmp

              Filesize

              272KB

            • memory/2060-54-0x0000000000860000-0x00000000008A4000-memory.dmp

              Filesize

              272KB

            • memory/2060-53-0x0000000000860000-0x00000000008A4000-memory.dmp

              Filesize

              272KB

            • memory/2060-52-0x0000000000860000-0x00000000008A4000-memory.dmp

              Filesize

              272KB

            • memory/2060-51-0x0000000000860000-0x00000000008A4000-memory.dmp

              Filesize

              272KB

            • memory/2060-64-0x0000000000240000-0x0000000000241000-memory.dmp

              Filesize

              4KB

            • memory/2060-66-0x0000000000240000-0x0000000000241000-memory.dmp

              Filesize

              4KB

            • memory/2060-68-0x0000000000240000-0x0000000000241000-memory.dmp

              Filesize

              4KB

            • memory/2060-70-0x0000000000240000-0x0000000000241000-memory.dmp

              Filesize

              4KB

            • memory/2060-72-0x0000000000240000-0x0000000000241000-memory.dmp

              Filesize

              4KB

            • memory/2060-1-0x0000000000720000-0x0000000000776000-memory.dmp

              Filesize

              344KB

            • memory/2060-76-0x0000000000240000-0x0000000000241000-memory.dmp

              Filesize

              4KB

            • memory/2060-62-0x0000000000240000-0x0000000000241000-memory.dmp

              Filesize

              4KB

            • memory/2060-153-0x0000000000240000-0x0000000000241000-memory.dmp

              Filesize

              4KB

            • memory/2060-172-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/2060-173-0x0000000000720000-0x0000000000776000-memory.dmp

              Filesize

              344KB

            • memory/2060-174-0x0000000000860000-0x00000000008A4000-memory.dmp

              Filesize

              272KB

            • memory/2060-97-0x0000000077270000-0x0000000077271000-memory.dmp

              Filesize

              4KB

            • memory/2060-95-0x0000000000860000-0x00000000008A4000-memory.dmp

              Filesize

              272KB

            • memory/2060-80-0x0000000000240000-0x0000000000241000-memory.dmp

              Filesize

              4KB

            • memory/2060-0-0x00000000006D0000-0x0000000000714000-memory.dmp

              Filesize

              272KB

            • memory/2060-2-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/2060-3-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/2060-7-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/2060-4-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/3000-15-0x0000000001BD0000-0x0000000001C14000-memory.dmp

              Filesize

              272KB

            • memory/3000-17-0x0000000001C20000-0x0000000001C76000-memory.dmp

              Filesize

              344KB

            • memory/3000-20-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/3000-191-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB