Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 21:23
Behavioral task
behavioral1
Sample
549da684889beb9630614e66e1654aef.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
549da684889beb9630614e66e1654aef.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
549da684889beb9630614e66e1654aef.exe
-
Size
7KB
-
MD5
549da684889beb9630614e66e1654aef
-
SHA1
66af13b22f6754b000a8567d66610871808070f3
-
SHA256
48796a10c47b2193264f0b720e0307ac25f21e40731b22bf4474a85c5d64a200
-
SHA512
b5e19ea106d11660464e705f847bed84af3d6ee98e197e5c475d519d0d3b17a96d12a1f29092f0d4566d62a292424367aad8943fb2e362fb57a03c6d3878d7e7
-
SSDEEP
192:AgmafBmNbWAYkVDkQsDtWIoVLVJBuE6yW:AUfBmolmQnDYVHBUb
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2168-0-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/2168-1-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/2168-10-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\‰:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\R:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\¶:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\Ì:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\]:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\À:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\ :\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\ï:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\8:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created F:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\˜:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\d:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created D:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\ì:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\ :\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\ :\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\ :\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\I:\autorun.inf 549da684889beb9630614e66e1654aef.exe File opened for modification F:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\ :\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\”:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\¼:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\|:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\,:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\Ð:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\$:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\p:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\ :\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\¸:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\«:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\ú:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\ÿ:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\Þ:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\§:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\L:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\-:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\û:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\x:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\ü:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\:\autorun.inf 549da684889beb9630614e66e1654aef.exe File opened for modification \??\f:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\V:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\G:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\h:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\Ä:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\v:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\×:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\@:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\6:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\{:\autorun.inf 549da684889beb9630614e66e1654aef.exe File created \??\þ:\autorun.inf 549da684889beb9630614e66e1654aef.exe -
Drops file in Program Files directory 11 IoCs
description ioc Process File created C:\program files\winmx\shared\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\kazaa\my shared folder\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\kazaa lite k++\my shared folder\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\bearshare\shared\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\edonkey2000\incoming\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\tesla\files\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\kazaa lite\my shared folder\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\icq\shared folder\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\grokster\my grokster\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\morpheus\my shared folder\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\limewire\shared\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2544 2168 WerFault.exe 89 -
NTFS ADS 11 IoCs
description ioc Process File created C:\program files\grokster\my grokster\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\bearshare\shared\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\edonkey2000\incoming\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\morpheus\my shared folder\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\limewire\shared\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\kazaa\my shared folder\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\kazaa lite k++\my shared folder\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\icq\shared folder\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\tesla\files\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\winmx\shared\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe File created C:\program files\kazaa lite\my shared folder\C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe 549da684889beb9630614e66e1654aef.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe"C:\Users\Admin\AppData\Local\Temp\549da684889beb9630614e66e1654aef.exe"1⤵
- Drops autorun.inf file
- Drops file in Program Files directory
- NTFS ADS
PID:2168 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 4362⤵
- Program crash
PID:2544
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2168 -ip 21681⤵PID:4028