2d8a069e58648aff01c3198cb9a650ca1837eb7076c6e1277e845fcab096b1da

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2d04bcc0372dd9a2c7ab14da55392290.exe
Size 752KB
Sample240201-kc16wsheap
SHA256 2d8a069e58648aff01c3198cb9a650ca1837eb7076c6e1277e845fcab096b1da
MD5 2d04bcc0372dd9a2c7ab14da55392290
SHA1 0c2a48bca4e48ccc394da64f8d235e59cdee94e1
SHA512 d033e22c08ce4078bbf8ad6727d712cfc33a1236df8c1dc5302717dadb255e0d614b85047552f1daff664c0f1b086a92747eba44ebdadaf43dc363c865388d47
SSDEEP 12288:CWJUDnv3qDuxspvNmk5lDZTEotOqxxrFKGn7cFbFTFD+HaINn6SNM7V2arQ4ws:T6v3q1dfb5IGnwFPD+646bV2alw
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk	2d04bcc0372dd9a2c7ab14da55392290.exe

Executes dropped EXE 1 IoCs

pid	Process
2264	SmartClock.exe

Loads dropped DLL 3 IoCs

pid	Process
2008	2d04bcc0372dd9a2c7ab14da55392290.exe
2008	2d04bcc0372dd9a2c7ab14da55392290.exe
2008	2d04bcc0372dd9a2c7ab14da55392290.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2264	SmartClock.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2264	2008	2d04bcc0372dd9a2c7ab14da55392290.exe	18
PID 2008 wrote to memory of 2264	2008	2d04bcc0372dd9a2c7ab14da55392290.exe	18
PID 2008 wrote to memory of 2264	2008	2d04bcc0372dd9a2c7ab14da55392290.exe	18
PID 2008 wrote to memory of 2264	2008	2d04bcc0372dd9a2c7ab14da55392290.exe	18

C:\Users\Admin\AppData\Local\Temp\2d04bcc0372dd9a2c7ab14da55392290.exe
"C:\Users\Admin\AppData\Local\Temp\2d04bcc0372dd9a2c7ab14da55392290.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
  "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SmartClock.exe

Path C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
Size 85KB
SHA256 d85e56b517f1443f75957c0f5cbbc9699996dac2330c10a61de19c7453ef4404
MD5 19cbf18a69b2a3515d9021d16bdd7b5b
SHA1 bd129e8c2f1601aa9001a5c80fcfdd64a6092e5b
SHA512 4dd4820bb446b4789695701172e2be846be9948f888bd3a50344baa536702d38d087f59c8c1fba7a3cb70eb67eb69a7f7415c5f6966ac7b4147ef79da0fd577c
SSDEEP 1536:CZIQuVVL5LpJYKcRJUsn/GXcb9jd4nJ21M7FZEp50i/:CZIQqVUDnkgZ4wKyZ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

SmartClock.exe

Path C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
Size 64KB
SHA256 b4def4377a215ef399c97235d930850cd1ce784aa430e57f44dd0bcf6d41cfe3
MD5 76d79677d01bfaba628e35294c87dec2
SHA1 3be5497ce68d24a32f6e05426b810a37d7cc9228
SHA512 36f2527a5ff543dfd342c3529fa0661de11a3bd82fd8b9b73d6ad547a0fb4413e3288395df98bfe29001919d4222c7f8970f6ca39538db3ea12681cef03b3175
SSDEEP 768:KznCeYKIlSuNP8fwVI4tpLLpmwIjX6MhmJ+nC6J3Ecxz2K/8Vcmcb9j4cMJ5WSSX:CZIQuVVL5LpJYKcRJUsn/GXcb9jd4nJQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SmartClock.exe

Path \Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
Size 80KB
SHA256 d964a69e8c7894fba8638811f14bc23b31a1aeb48ac6b60f6cce05eb81348dc8
MD5 03253c169cee1a31da9dcdab215a5d93
SHA1 ef5354e5b1a03adc678ca971c2c24191726c95a0
SHA512 41c8f62460a14abb767e1a9c043278440e9d34503d1c289b673cce219f316827b59cb7fbe34f080350b5b37b8f14f3a41692e4d2df494bb6a23c588d9330977e
SSDEEP 1536:CZIQuVVL5LpJYKcRJUsn/GXcb9jd4nJ21M7FZi:CZIQqVUDnkgZ4wKq
MD5 SHA1 SHA512 SSDEEP

Submit Download

SmartClock.exe

Path \Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
Size 50KB
SHA256 4ad716e6bff4ba257f5975cf1dfce9b8022c29e6a951e3ad857751deeff6e617
MD5 1dc926fccec500c014894b8c1fbbcbea
SHA1 cea34b0ba37e49dd88be14fb4782f2ae36195801
SHA512 38456212ede14c72d4ab20f1572d83cf2801bb682ab3adbd21741adb4d4347ba3eab0e22ee6a0dbd5280b4c12510b61b7d338fc9e42075682363d5bd07a45fdf
SSDEEP 768:KznCeYKIlSuNP8fwVI4tpLLpmwIjX6MhmJ+nC6J3Ecxz2K/8Vcmcb9R:CZIQuVVL5LpJYKcRJUsn/GXcb9R
MD5 SHA1 SHA512 SSDEEP

Submit Download

SmartClock.exe

Path \Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
Size 24KB
SHA256 687890a30285a0caf90df60b3d761e22931a3af8626e47d2f35cad7eb6c059b4
MD5 9e22448a402d71810dcb041c7dd20907
SHA1 171b2a2c353b740d054a300dfbf4728b630e40cc
SHA512 5fa183b4688053f6d99d69322db1c5b34c6c27e41412e55626aafed278259ed3e4267a803894d5fce0559b27e97abe383e781b663976b97505867bf524e3b05f
SSDEEP 384:24dwCcrn0UDBPy3Oj0WVckEf318xmh6XxViYOyMik8stC1wVd64tpLLD/d+FY52U:KznCeYKIlSuNP8fwVI4tpLLpmy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2008-2-0x0000000000220000-0x00000000002A0000-memory.dmp

Download

memory/2008-16-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/2008-4-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/2008-3-0x0000000000340000-0x00000000003D1000-memory.dmp

Download

memory/2008-0-0x0000000000220000-0x00000000002A0000-memory.dmp

Download

memory/2264-19-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/2264-17-0x0000000000220000-0x00000000002A0000-memory.dmp

Download

memory/2264-18-0x0000000000220000-0x00000000002A0000-memory.dmp

Download

memory/2264-21-0x0000000000220000-0x00000000002A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads