9b9d900dc96e20a67c03c6fe3157e9ca96f993b310fff8f5108aeff29af7c160

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 08:01

Target

9b9d900dc96e20a67c03c6fe3157e9ca96f993b310fff8f5108aeff29af7c160.exe
Size

2.4MB
MD5

251a07949290769a2a5a949d8f2b225b
SHA1

99bcddbe92c39a378b29c81950019abaeb175774
SHA256

9b9d900dc96e20a67c03c6fe3157e9ca96f993b310fff8f5108aeff29af7c160
SHA512

ce2530d64f5ef3d2d0eb06a1d2aad62b8334486335fe76e4489199ea9ea8fe27639f02e6e459c475925d77b8af83f741cde460b481f3e283e0c25556981a6cb9
SSDEEP

49152:1e8Pbe4aJLOeOQD63cqM91/3/yPpjfNBqWUa5mAlOKVtSquYS66p5yBtroB8qXIV:1eSgJLDOQD6MV91/3/yRbNBqWUBLKVYU

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2352	DySDKController.exe

Loads dropped DLL 1 IoCs

pid	Process
1792	9b9d900dc96e20a67c03c6fe3157e9ca96f993b310fff8f5108aeff29af7c160.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Funshion\cvsd.xml	9b9d900dc96e20a67c03c6fe3157e9ca96f993b310fff8f5108aeff29af7c160.exe
File created	C:\Program Files (x86)\Funshion\DyCrashRpt.dll	9b9d900dc96e20a67c03c6fe3157e9ca96f993b310fff8f5108aeff29af7c160.exe
File created	C:\Program Files (x86)\Funshion\DySDKController.exe	9b9d900dc96e20a67c03c6fe3157e9ca96f993b310fff8f5108aeff29af7c160.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1792	9b9d900dc96e20a67c03c6fe3157e9ca96f993b310fff8f5108aeff29af7c160.exe
1792	9b9d900dc96e20a67c03c6fe3157e9ca96f993b310fff8f5108aeff29af7c160.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1792	9b9d900dc96e20a67c03c6fe3157e9ca96f993b310fff8f5108aeff29af7c160.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2352	1792	9b9d900dc96e20a67c03c6fe3157e9ca96f993b310fff8f5108aeff29af7c160.exe	28
PID 1792 wrote to memory of 2352	1792	9b9d900dc96e20a67c03c6fe3157e9ca96f993b310fff8f5108aeff29af7c160.exe	28
PID 1792 wrote to memory of 2352	1792	9b9d900dc96e20a67c03c6fe3157e9ca96f993b310fff8f5108aeff29af7c160.exe	28
PID 1792 wrote to memory of 2352	1792	9b9d900dc96e20a67c03c6fe3157e9ca96f993b310fff8f5108aeff29af7c160.exe	28

C:\Users\Admin\AppData\Local\Temp\9b9d900dc96e20a67c03c6fe3157e9ca96f993b310fff8f5108aeff29af7c160.exe
"C:\Users\Admin\AppData\Local\Temp\9b9d900dc96e20a67c03c6fe3157e9ca96f993b310fff8f5108aeff29af7c160.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files (x86)\Funshion\DySDKController.exe
  "C:\Program Files (x86)\Funshion\DySDKController.exe"
  2⤵
  - Executes dropped EXE
  PID:2352

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Program Files (x86)\Funshion\DyCrashRpt.dll

Filesize
142KB

MD5
f4e8f95ef1dc8ac0406511fb489d5aa3

SHA1
259d274b31c7fe8152a0cc9aa2966164fe1d4113

SHA256
237a17b9d328255a03bd00578d9e4b9643201c367db4de7ed3a0912ce6c362b8

SHA512
f38b12cd4c8c7c96d36d92237cd1ddc8120443247150c826f9b590b08068d1f450aebe874c3efbaba4b191e81b856af022b5dd81932f23daf4df7b426efb61cd

Download Submit
C:\Program Files (x86)\Funshion\DySDKController.exe

Filesize
384KB

MD5
c8b59887b5dbc258dd876f721f1d997a

SHA1
c301c20207f32d96c92280f4303dc2d5e0924c9a

SHA256
66fc638bb3bd8b906a19681221c117b177b4a0df79b8c42efc4fe941276d6c2a

SHA512
e7f09f6ad35c9b4d3af6247a5770fd8f5975b65ad36fe7a70b1d33636b7a91d526a903879868475472df0d8b4f436c5e456ebc721c46cc026bd539bb1003cce6

Download Submit
\Program Files (x86)\Funshion\DySDKController.exe

Filesize
385KB

MD5
e768abc40e7b61943d8dfb6e403f89d5

SHA1
53e72b0d952ab6d987edccb683e40b81058ab319

SHA256
1ee647f14df15ed6305852cbbef1f6e16f543247fa5f2142c630494153e15982

SHA512
a24ddd1435c9dfc6cfd3a63c7da6e4fb3cf89cc2d3af40c34840508227c9b058569c4687c40f914ee094e822ea4d16660fbb45ec679ca4fabf0bca54113d207e

Download Submit