2d8a069e58648aff01c3198cb9a650ca1837eb7076c6e1277e845fcab096b1da

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2d04bcc0372dd9a2c7ab14da55392290.exe
Size 752KB
Sample240201-kc16wsheap
SHA256 2d8a069e58648aff01c3198cb9a650ca1837eb7076c6e1277e845fcab096b1da
MD5 2d04bcc0372dd9a2c7ab14da55392290
SHA1 0c2a48bca4e48ccc394da64f8d235e59cdee94e1
SHA512 d033e22c08ce4078bbf8ad6727d712cfc33a1236df8c1dc5302717dadb255e0d614b85047552f1daff664c0f1b086a92747eba44ebdadaf43dc363c865388d47
SSDEEP 12288:CWJUDnv3qDuxspvNmk5lDZTEotOqxxrFKGn7cFbFTFD+HaINn6SNM7V2arQ4ws:T6v3q1dfb5IGnwFPD+646bV2alw
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk	2d04bcc0372dd9a2c7ab14da55392290.exe

Executes dropped EXE 1 IoCs

pid	Process
4356	SmartClock.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4644	4968	WerFault.exe	83

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4356	SmartClock.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4356	4968	2d04bcc0372dd9a2c7ab14da55392290.exe	87
PID 4968 wrote to memory of 4356	4968	2d04bcc0372dd9a2c7ab14da55392290.exe	87
PID 4968 wrote to memory of 4356	4968	2d04bcc0372dd9a2c7ab14da55392290.exe	87

C:\Users\Admin\AppData\Local\Temp\2d04bcc0372dd9a2c7ab14da55392290.exe
"C:\Users\Admin\AppData\Local\Temp\2d04bcc0372dd9a2c7ab14da55392290.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1000
  2⤵
  - Program crash
  PID:4644
- C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
  "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4968 -ip 4968
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SmartClock.exe

Path C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
Size 93KB
SHA256 ef3a9adb1b876d4dc4a40e81652f5c443e9fea82bd41fdd24c67233a6a38db4d
MD5 dca11eb23a456e8b09d79c1139c56b12
SHA1 601d3da1e88f2f657025fb7b793001e35c281978
SHA512 6598949bb8cbcda8611da42f03c4cedb8a3d5de381639b9c6fb7bc17056232e614e537e81f7507946d85cb52717761d1164fc055d598f3971444c9f2a02027ae
SSDEEP 1536:CZIQuVVL5LpJYKcRJUsn/GXcb9jd4nJ21M7FZEp50ibqxY4zq:CZIQqVUDnkgZ4wKyZWYt
MD5 SHA1 SHA512 SSDEEP

Submit Download

SmartClock.exe

Path C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
Size 116KB
SHA256 daf6dff0b001e6ad917f0ea1e551c109602b5400d7dbc0cddd5f6291883123ff
MD5 3179fc6c2d5117748135ba4663c1441d
SHA1 6eba3831ad20f3ed337b11f6bb04b025bcd9c19c
SHA512 6d84489c7302553b38032fae3e6575c2adbe4c67e5d7485cfedc6a9884e64673c34fb930e82ca8040657188ba1d4b65c965936163b7aa448a8fb01c42d3c2010
SSDEEP 1536:CZIQuVVL5LpJYKcRJUsn/GXcb9jd4nJ21M7FZEp50ibqxY4zWDmV0+8UPyxqW1d+:CZIQqVUDnkgZ4wKyZWY3qCiPUqW1dkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4356-12-0x0000000000740000-0x00000000007C2000-memory.dmp

Download

memory/4356-13-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/4356-18-0x0000000000740000-0x00000000007C2000-memory.dmp

Download

memory/4968-1-0x0000000002210000-0x0000000002295000-memory.dmp

Download

memory/4968-2-0x00000000022E0000-0x0000000002371000-memory.dmp

Download

memory/4968-3-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/4968-15-0x00000000022E0000-0x0000000002371000-memory.dmp

Download

memory/4968-14-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads