Analysis

  • max time kernel
    117s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 05:06

General

  • Target

    06c096ef02409a3c521000f055f18aae.exe

  • Size

    47KB

  • MD5

    06c096ef02409a3c521000f055f18aae

  • SHA1

    eb928088dd733c5ee8e6548c01c91a00273965f7

  • SHA256

    28e601005be1df1a0fb521da76e163d34d63901c38c5972a573962dda8fa40b8

  • SHA512

    030473b3073ec75eb1e13d363cf6d0c0d1da1605fc3dcf4d3808d0ff1699a6a2c95ad95acbfc9dd0f7db8a29bc5c6bbf0af914db05e4f6de09a413791142d545

  • SSDEEP

    768:DpiEXtk3URj+1YDP1U2ptH5NwCes0GUEQZwaKH3xm4KJ7tbveXr8RdNu087eiv8I:wURjsYDtXptH5NwCes0GUEQZwaKH3xm1

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:2
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:2748
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2692
  • C:\Windows\SysWOW64\Windefend.exe
    "C:\Windows\system32\Windefend.exe" rem "C:\Users\Admin\AppData\Local\Temp\06c096ef02409a3c521000f055f18aae.exe"
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2736
  • C:\Users\Admin\AppData\Local\Temp\06c096ef02409a3c521000f055f18aae.exe
    "C:\Users\Admin\AppData\Local\Temp\06c096ef02409a3c521000f055f18aae.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2192

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          8f7f8df8a1741f90d7cc29cf74984f60

          SHA1

          b92ee09153e07792f7aa33319f90e949a45a9cfb

          SHA256

          427b1e5b8c8a5faede3a733acc4f3513d45718bfc2cb3b645759bfbf5756446c

          SHA512

          beb1cca0014fb82ba88218f772b2898a6daa84a572ce40350dce8601056d8da9b1d6c0c9be83d7f100e4ffde3e887356ba685b519a6aa816ac4eaeab36a403a8

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          325d2175ec102797dcc9276db95f0643

          SHA1

          392f9a96bb3ad655271a6fda8aebf885076c644e

          SHA256

          6116514bdf955a024473f2189e3a41438f66990eea29ed2735abf6ca525dc8b6

          SHA512

          4868fa5aba4e442bd7f018951e24eae0831fcf38f0b24a9edba79ef04ba2c4ccbf531a7c31a6bc92f3f2628eaa362b94f4ee0e2cf7a814ca2b305131077fbabb

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          016db6fd0c61b56003a2a4acf061308e

          SHA1

          dcdae6c523ae2952065ceb92432b4cf1093afc15

          SHA256

          373e712fa279d004b3550c4b3ec80edb5545984d7305992413a49652ef73f17c

          SHA512

          df9b9963c46d9b6ebcd2fc949ebdbd110feab9fada01fdb65211b5b524673d859f5ed0e94aa42cb107712d18f128767cb1c5c7cc9d2705c6c716aff85b748cce

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          4f4d4756b6d4581b9920221f008dec5a

          SHA1

          31fcb90ffe21f73c14366fd6cd5301f4204831c7

          SHA256

          1f9ad39588e456af9fe06cb76a5c30d3a6ce8f32038c1e5f478fc9caa2f4f8bc

          SHA512

          79724ee00d2a3eea4d4641a1e3bbf6b9ae6dd005254815da30ae5831939176c8a9a426e3383d7342402d9610881535cf00a3862120090bfe0df1f5161a094698

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          f20f9deb2a63c1496898e1bd2d3de2f9

          SHA1

          b135d9d5312e57fbb32d25238f4469a8266c842b

          SHA256

          28308d48fbdcf9516e3986966a80f418bb66b79e5f06289d888bf44f1b7c6431

          SHA512

          57201b8a07f2a03e632b761788d870fd32aaf246812151122827a0a30bdf78b3c0d5910c912e467f5e1982b971e9c922d26506725e8770bd2e7495ae82df32c0

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          c10cd748514af7d721ef3f96779beeba

          SHA1

          0590194afc7c3c370786f744c775a57384771812

          SHA256

          dfe0c09ee57f83155a71e4bd9747d20526cca55390c2886c080a140d13ef56ec

          SHA512

          e14698b45076f52258466eb132b4a947e852a5822cfb7d9741c6ad8fb24350ab80f9ea839e9bcfe6f63f759275135c3536a0db8b0ff7debc49b5ff570f34dbf8

        • \Windows\SysWOW64\Windefend.exe

          Filesize

          47KB

          MD5

          06c096ef02409a3c521000f055f18aae

          SHA1

          eb928088dd733c5ee8e6548c01c91a00273965f7

          SHA256

          28e601005be1df1a0fb521da76e163d34d63901c38c5972a573962dda8fa40b8

          SHA512

          030473b3073ec75eb1e13d363cf6d0c0d1da1605fc3dcf4d3808d0ff1699a6a2c95ad95acbfc9dd0f7db8a29bc5c6bbf0af914db05e4f6de09a413791142d545