Analysis
-
max time kernel
79s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01/01/2024, 03:43
General
-
Target
SecuriteInfo.com.FileRepMalware.17033.29620.exe
-
Size
4.7MB
-
MD5
a143e23435905aaee78cca98f920b419
-
SHA1
32f33d44b67f41e438dbb81568f3cc0c566318b8
-
SHA256
cdc42d582dcfc216e12fd59853ed4d26affbc1a5615d5a578872f674272dd80f
-
SHA512
7182fd24418be9ade21027a9cefa167c2d58cb23ad5ea834244d156894d9e18abd4c6fd1e0e1e53834d406fa6e58ca2013f0aa3cd97a3cb0111069d55c5bd73b
-
SSDEEP
98304:Q3mosrpRSHF9xN7hSYSmNNgl0+LP0d6UdDkXUymC5TBJvMwMgiCDhokKvk4dm8:csrpRoF9DXJNN6bL05ZkX9mC11Mhs9Kz
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 51 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.17033.29620.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.17033.29620.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NPEB5.tmp\SecuriteInfo.com.FileRepMalware.17033.29620.tmp"C:\Users\Admin\AppData\Local\Temp\is-NPEB5.tmp\SecuriteInfo.com.FileRepMalware.17033.29620.tmp" /SL5="$40212,4622594,54272,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.17033.29620.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 313⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 314⤵
-
-
-
C:\Program Files (x86)\Video Storage EXT\vstorage-extension.exe"C:\Program Files (x86)\Video Storage EXT\vstorage-extension.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Video Storage EXT\vstorage-extension.exe"C:\Program Files (x86)\Video Storage EXT\vstorage-extension.exe" -i3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5cebc5366f86e44a821bc39619ca46080
SHA157d5d725abe44f7edb8d8b4cacf8bc7d813df1bd
SHA2567a5ba224bc99cd03ac5c49a044cb7aa81e2d2a904a7f08897221d6d9ead1b4f6
SHA512683b23753272fe090507213da92912e9c3e20849af9811be848532eb67e950a5a26f689abb2630d89e639802a2d9e8824c88e710364ecc14b8ac14581bff950a
-
Filesize
21KB
MD5bcf18951219a399626e3ad410bb54ab4
SHA1286b539392354561fd5864333e4dc3106fa1ac0f
SHA2560918c0a7f62e5263d9ab65cbb30e0a973accb375d487e22d80570f61333d61ff
SHA51249f816714051ca36448ceb6c448ebd01cbd2c5a2519b10267232aa32769184acfb49b45cd4a3a68ec6e416b4ccbdce0c0450c003e371840645c7d9d6a5309278
-
Filesize
50KB
MD586e0428588ef1adfd8cd8c7edaf1310e
SHA1848cd333c177ea413d9fff836fa9df8de18de27e
SHA2560db0887f3f2d684a75ada07936e49cd39930fb9424370a7363956ccac6d2cdc5
SHA51225fb10a0cf9194b6245810e8653ef204c7e7033618ed184088ebc86bc18d9ee6a9286d4c373ab5e295e28754ab5b318a78fd2dc2c4d421291ff3734ddf721bf1
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
2KB
MD5a28282056aed6b03457a9b16c5434770
SHA173a9d9279736aba2124010b3e078a8d4353b9e32
SHA256c0c9bccdcc45846b3102755a87c233de6cd6700c95fab815672ed618c6275a35
SHA512311ba570d562c515228196269266b54a7c785c637118276c12b1d8e707a2db14d47168385d8572990855f2fe7baae5fb60945082b414e3db6d60451b26a18fd2
-
Filesize
6KB
MD5eec4c933d4e7f0fd1a92a482004d750c
SHA11ced76db341f6a71dc6d5b7f90106092a5bc4cd7
SHA2567a679de19dd29206dcaf83492fc0d009585fb3efc8ef073ba715185bdb79a06a
SHA5125856b5e4505d705f6b63f1752a901814310a43c0bfa3b8bbc28574faeb50df61d58aba62b9b12f73153f5b2ae77d64f914b0bcbed202ae8d7f8b722248a2fec1
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
648KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
648KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB