Analysis

  • max time kernel
    120s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 18:51

General

  • Target

    35c46340a0b4fc35b0495e126d3e65cf.exe

  • Size

    243KB

  • MD5

    35c46340a0b4fc35b0495e126d3e65cf

  • SHA1

    6a4cf46d8884cfe327e2c9bb748851b78ea5e5e4

  • SHA256

    25e79cbf64d56da002613cdb7303f05ce76654170f9a03cc590e85f6c392817d

  • SHA512

    d5d82d762198567d3ff7b6af9c1459ed02752efb5faadef0326db726f0b26af8d35a43cd28274c114a58ade18f0697d667b1a26344592712ff2787110a3e1297

  • SSDEEP

    6144:h1OgDPdkBAFZWjadD4s54DhFmWZgmKlq0h:h1OgLdaOQ8CQ

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 4 IoCs
  • Modifies registry class 45 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35c46340a0b4fc35b0495e126d3e65cf.exe
    "C:\Users\Admin\AppData\Local\Temp\35c46340a0b4fc35b0495e126d3e65cf.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Local\Temp\7zS7455.tmp\50dd85e07e450.exe
      .\50dd85e07e450.exe /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      • System policy modification
      PID:2700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\wxDownload\uninstall.exe

    Filesize

    48KB

    MD5

    e9c9582996a23b2a49a058dcaa3b5525

    SHA1

    f527cc64e759f06c011e5eeffbd217d5249c04df

    SHA256

    43c3e8d7aa00a299f084db17e384aa96de508565f82264ee88bd9c7647fa9fc9

    SHA512

    665613fc7f20e2c4ea40b7a8f39b4c2ea2a24c5119ee86ef072bbe29f606cd78a43081aa0a89b678a46d34e470e1ed10e31d590d3cb5447e1231707fea8e490f

  • C:\Users\Admin\AppData\Local\Temp\7zS7455.tmp\50dd85e07e487.dll

    Filesize

    115KB

    MD5

    6696822add17061dc0bb8ee5b42cc2d4

    SHA1

    d4622558ba366f2f94560da301a81c6c16f95a3c

    SHA256

    73c44d8943947e3cf9ecabdeea4d9a37652614f5490a1f972816be4123795125

    SHA512

    0f1946ce002441d010f67156f67b9d18e01ba35edfeb66ce8096467d3126b547e5040032253275b173f2dba9bce983775f360d83ec026986b55cb85e4b63f099

  • C:\Users\Admin\AppData\Local\Temp\7zS7455.tmp\50dd85e07e487.tlb

    Filesize

    2KB

    MD5

    096a65b8a695249d5d554776f1eeace3

    SHA1

    2f2506b886a59b4408b23653d8734004ec2dda6d

    SHA256

    a602c790bcf424c154a082a88a495b256dd5456f627943568c358c74f606c568

    SHA512

    6e832caff1951b4fdb489997af5736fdbafa1de5573f629fc6798666bffd0ca0715311ce6590202cc970cce4492d94994a588547bb579bf70bc264683bc45cdc

  • C:\Users\Admin\AppData\Local\Temp\7zS7455.tmp\settings.ini

    Filesize

    6KB

    MD5

    f3be78a06ed7319d35732ba8f81bc777

    SHA1

    cf5f5c0db599a3743fc734b60b885d943923fa69

    SHA256

    b05f52787c2ea0a62e4b50cc4aebcf79b96e4dbcd804161dd2b7fdba4839f624

    SHA512

    98c80c04a2a48cd140723385851018a1bd997956377f748f608c2ce5a9efb58be487037df720b7289c2eb037e2daec1959fee0bdac156ae7b30f6dede4406042

  • \Users\Admin\AppData\Local\Temp\7zS7455.tmp\50dd85e07e450.exe

    Filesize

    70KB

    MD5

    ebcc3eb1a7021aaead55fb677465a717

    SHA1

    3c8347f0fd520ee423a4aafea1112a0b06f4b6c8

    SHA256

    5e74f0e710c067ad82301c7c14ed6afb138f974f351042cfe0ecd275cea2612c

    SHA512

    0f18c22e6eff8ec90ccc616e62f32701d046185311e01e5f506778fae0c31f35123c3ce756ff2c0eef6f23e06e280f870b80080d11dc6da3aa25901f5a92d995

  • \Users\Admin\AppData\Local\Temp\nso757F.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    7579ade7ae1747a31960a228ce02e666

    SHA1

    8ec8571a296737e819dcf86353a43fcf8ec63351

    SHA256

    564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

    SHA512

    a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b