Analysis

  • max time kernel
    0s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 19:21

General

  • Target

    Mesh Method_65518065.exe

  • Size

    9.5MB

  • MD5

    93d16508432c3ff3512eb9de584f48e6

  • SHA1

    6ed9fd4d190afc6c5154730d85cf883fd3ad4d2e

  • SHA256

    be5357f63b036da79d198978cbc5b652ea02b1ccfcb1538352442cdc7f4d5549

  • SHA512

    08ad71f9b6b3a65cb22b6a65c8e44d4e004de2d10683dd89a8eac5af67127b126db301ca55e00740e7342c2896cf4b7178257e9d4e446a03db13e122c4116338

  • SSDEEP

    196608:MulB4qN8C0lgVk2rqNemQ3bKfIiaNPFHNRsiK:jee87gbrqNeL3bIIiEHMn

Score
1/10

Malware Config

Signatures

  • Delays execution with timeout.exe 3 IoCs
  • Enumerates processes with tasklist 1 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Mesh Method_65518065.exe
    "C:\Users\Admin\AppData\Local\Temp\Mesh Method_65518065.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1888
    • C:\Users\Admin\AppData\Local\setup65518065.exe
      C:\Users\Admin\AppData\Local\setup65518065.exe hhwnd=459042 hreturntoinstaller hextras=id:ad413892c2b60f5-RO-L18kY
      2⤵
        PID:832
        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe
          "C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe"
          3⤵
            PID:2692
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
              4⤵
                PID:1696
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  5⤵
                  • Delays execution with timeout.exe
                  PID:2460
                • C:\Windows\SysWOW64\find.exe
                  find /I "2692"
                  5⤵
                    PID:2932
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /FI "PID eq 2692" /fo csv
                    5⤵
                    • Enumerates processes with tasklist
                    PID:2476
                  • C:\Windows\SysWOW64\find.exe
                    find /I "2692"
                    5⤵
                      PID:2212
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      5⤵
                      • Delays execution with timeout.exe
                      PID:356
                    • C:\Windows\SysWOW64\tasklist.exe
                      tasklist /FI "PID eq 2692" /fo csv
                      5⤵
                      • Enumerates processes with tasklist
                      PID:2232
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
                  3⤵
                    PID:3032
                • C:\Users\Admin\AppData\Local\setup65518065.exe
                  C:\Users\Admin\AppData\Local\setup65518065.exe hready
                  2⤵
                    PID:2228
                • C:\Windows\SysWOW64\find.exe
                  find /I "832"
                  1⤵
                    PID:1272
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 5
                    1⤵
                    • Delays execution with timeout.exe
                    PID:1904
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /FI "PID eq 832" /fo csv
                    1⤵
                    • Enumerates processes with tasklist
                    PID:1780

                  Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/832-55-0x0000000000A20000-0x0000000000A44000-memory.dmp

                          Filesize

                          144KB

                        • memory/832-273-0x0000000004CE0000-0x0000000004CEA000-memory.dmp

                          Filesize

                          40KB

                        • memory/832-47-0x0000000000470000-0x0000000000484000-memory.dmp

                          Filesize

                          80KB

                        • memory/832-139-0x0000000004BC0000-0x0000000004BDD000-memory.dmp

                          Filesize

                          116KB

                        • memory/832-155-0x0000000004C70000-0x0000000004C82000-memory.dmp

                          Filesize

                          72KB

                        • memory/832-127-0x00000000047C0000-0x00000000047EC000-memory.dmp

                          Filesize

                          176KB

                        • memory/832-119-0x0000000004790000-0x0000000004798000-memory.dmp

                          Filesize

                          32KB

                        • memory/832-111-0x00000000044C0000-0x00000000044CA000-memory.dmp

                          Filesize

                          40KB

                        • memory/832-103-0x0000000004510000-0x0000000004534000-memory.dmp

                          Filesize

                          144KB

                        • memory/832-95-0x0000000000A80000-0x0000000000A9A000-memory.dmp

                          Filesize

                          104KB

                        • memory/832-87-0x0000000004480000-0x00000000044B2000-memory.dmp

                          Filesize

                          200KB

                        • memory/832-79-0x0000000000B50000-0x0000000000B78000-memory.dmp

                          Filesize

                          160KB

                        • memory/832-71-0x0000000000B20000-0x0000000000B4E000-memory.dmp

                          Filesize

                          184KB

                        • memory/832-63-0x0000000000A50000-0x0000000000A78000-memory.dmp

                          Filesize

                          160KB

                        • memory/832-26-0x0000000000CA0000-0x0000000001078000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/832-27-0x0000000072BB0000-0x000000007329E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/832-282-0x00000000055A0000-0x00000000055AC000-memory.dmp

                          Filesize

                          48KB

                        • memory/832-266-0x00000000060B0000-0x000000000613C000-memory.dmp

                          Filesize

                          560KB

                        • memory/832-30-0x0000000004D80000-0x0000000004DC0000-memory.dmp

                          Filesize

                          256KB

                        • memory/832-290-0x0000000007300000-0x00000000078B4000-memory.dmp

                          Filesize

                          5.7MB

                        • memory/832-317-0x0000000005620000-0x000000000564E000-memory.dmp

                          Filesize

                          184KB

                        • memory/832-751-0x0000000072BB0000-0x000000007329E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/832-521-0x0000000004D80000-0x0000000004DC0000-memory.dmp

                          Filesize

                          256KB

                        • memory/832-520-0x0000000072BB0000-0x000000007329E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/2228-466-0x0000000072BB0000-0x000000007329E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/2228-480-0x00000000004E0000-0x0000000000520000-memory.dmp

                          Filesize

                          256KB

                        • memory/2228-482-0x0000000072BB0000-0x000000007329E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/2692-740-0x0000000072BB0000-0x000000007329E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/2692-741-0x0000000004850000-0x0000000004890000-memory.dmp

                          Filesize

                          256KB

                        • memory/2692-739-0x00000000000E0000-0x00000000000EC000-memory.dmp

                          Filesize

                          48KB

                        • memory/2692-759-0x0000000072BB0000-0x000000007329E000-memory.dmp

                          Filesize

                          6.9MB