Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 14:48
Behavioral task
behavioral1
Sample
0222794aea4fb770257b3e9e3f0935b9.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0222794aea4fb770257b3e9e3f0935b9.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0222794aea4fb770257b3e9e3f0935b9.exe
-
Size
591KB
-
MD5
0222794aea4fb770257b3e9e3f0935b9
-
SHA1
91670b72550669e6254071834c04e449b1918c6d
-
SHA256
e8727ddc01dab3c6961d9f3dd569e01ae80600f5f3e9abb1a41631978084c36b
-
SHA512
c96e25826880f1595ba4c7edbadbbd4bae77bf22b3b190bf8afc8f185fb0a7de55c41105df64a464924d97270235a686ea77e5fdf2b39ee50808cd78489f41f4
-
SSDEEP
12288:erFbkdvryD1N6oZqiuArohCIOCVNd7zG0WLzCFn7/ewKlGMVHwi0/IH:eJbmrIr6oZ7IVZW0WXw7/ecMqiAE
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4772 stop.exe -
resource yara_rule behavioral2/memory/1568-0-0x0000000000400000-0x00000000004C0000-memory.dmp upx behavioral2/files/0x000700000002320e-5.dat upx behavioral2/memory/1568-8-0x0000000000400000-0x00000000004C0000-memory.dmp upx behavioral2/memory/4772-12-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1568-13-0x0000000000400000-0x00000000004C0000-memory.dmp upx behavioral2/memory/4772-14-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1568-17-0x0000000000400000-0x00000000004C0000-memory.dmp upx -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1568-8-0x0000000000400000-0x00000000004C0000-memory.dmp autoit_exe behavioral2/memory/1568-13-0x0000000000400000-0x00000000004C0000-memory.dmp autoit_exe behavioral2/memory/4772-14-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral2/memory/1568-17-0x0000000000400000-0x00000000004C0000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\stop.exe 0222794aea4fb770257b3e9e3f0935b9.exe File opened for modification C:\Windows\stop.exe 0222794aea4fb770257b3e9e3f0935b9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe 1568 0222794aea4fb770257b3e9e3f0935b9.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4772 stop.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1568 wrote to memory of 2528 1568 0222794aea4fb770257b3e9e3f0935b9.exe 90 PID 1568 wrote to memory of 2528 1568 0222794aea4fb770257b3e9e3f0935b9.exe 90 PID 1568 wrote to memory of 2528 1568 0222794aea4fb770257b3e9e3f0935b9.exe 90 PID 1568 wrote to memory of 4772 1568 0222794aea4fb770257b3e9e3f0935b9.exe 93 PID 1568 wrote to memory of 4772 1568 0222794aea4fb770257b3e9e3f0935b9.exe 93 PID 1568 wrote to memory of 4772 1568 0222794aea4fb770257b3e9e3f0935b9.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\0222794aea4fb770257b3e9e3f0935b9.exe"C:\Users\Admin\AppData\Local\Temp\0222794aea4fb770257b3e9e3f0935b9.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C \\game\command$\setup.bat2⤵PID:2528
-
-
C:\Windows\stop.exeC:\Windows\stop.exe2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:4772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
293KB
MD5c94f0354f50198afe394788c82f2a72d
SHA1ea491e3b050e467b784ba4b656da179f06fce31f
SHA25644edf11f1d0ab61edd5f9dd95a82416ed6a3074e2d4b0e7a239b1ff3e6c0d6f1
SHA512dfbac6853e67effc670de63abf894d3f842dbe02b09bda7095485a79210513f0948f54e58fa52609e3aafc10c441c302924185c95754fa5fbefa372bf0388f36