Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/02/2024, 23:57

General

  • Target

    97f32744d4aad83c8d8c1b18513133b8.exe

  • Size

    363KB

  • MD5

    97f32744d4aad83c8d8c1b18513133b8

  • SHA1

    22f19c589a85be1cdfca13dce249fcb38bc083ab

  • SHA256

    c6b6444af659370adc1a501e125efcf765de1e67ec5a376c5377bb1755bde66b

  • SHA512

    156695e071cea2d55511cf4d6ad83338a8a6c419576351f188e33c7e8b742cc3f56b4b238379127d4cba58be2c3ccb09443256aab0ea57121891ea114ad6cdbd

  • SSDEEP

    6144:POWMn+s7nfF0eNGbNTt9G39yupfg+gmHE/8woJQNFhIv/jJGi5U8JmEl:inZ7nt0euTtInRg+JHEGyIXjAi5j8K

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97f32744d4aad83c8d8c1b18513133b8.exe
    "C:\Users\Admin\AppData\Local\Temp\97f32744d4aad83c8d8c1b18513133b8.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" www.soasgatas.com
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2192
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" www.soasgatas.com
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2200
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2200 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    343ab1f1078d7c99934de73b8b5e3794

    SHA1

    6f886a6f957fccb24c5048d0b36a85c34d9c9cef

    SHA256

    d918241dfaaf7617baa42d9d51d8cd7059900d570a998aaa723b1a337b319a9e

    SHA512

    3320bbb45335521e7d353c2fca8b35dff32748bd626edc51926fa8692092bc6c9e965d4c0417353de2a43f0b1f9a12c08345c9b08ef378bc4c629a0f1acf7b31

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c4230589d879afd31abf31d6183fed41

    SHA1

    3b3c698badd06e90f6f326738fc7df30d2788a75

    SHA256

    c46231c4af378864f930c8e04906aad8ff1f62daf93914dba42de8fd1bca2feb

    SHA512

    adef725c29624f704d8919d25b31ccfd186ce7eb0636b7874cbbf580d97a64e21d1ec92d95fe700beb1047648a43b835877a051e6cb2f5bb3b364f387edd94b8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    af11c9b1a4f521aa4b33046a35252740

    SHA1

    7cf5c052f57438928ab99b23f74f69bf5232e0d7

    SHA256

    478c70804f6052fab36a2c7c1e19ddb1ab08ad8df33eafee8370dabd4f2da9e8

    SHA512

    9f5c8b75621654efcef6d64030f04174056b4843bf8114824c0c3c82c43354c389854bfb3cb1eeae07c60d9aa3b560076626de6bccaa6843a2a4d56e363d8a26

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7699ef8bbf53b6a3f8fc245dd0174cea

    SHA1

    bcd2bbb773408159007bac81a2d6018bd5165645

    SHA256

    5cb866f30cf2c5fbfcd5e091df40a7f3f461ffbec7d53583c6d28e29555dc211

    SHA512

    4155cb56c60d5763478f42b12dbbdc1af60b2ba5c1c5e1e31e55718113592341ff450b1bf61ecb91610bfc9f841e2be11d99a3d1114aabce0ee504ca254759a3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    45d061f4eb50c573910a6a7d2f2b835e

    SHA1

    714f3b995c2c776f409b577d52584264546ee3bc

    SHA256

    d20a4da7ef41baafbf6c4212c501cb57e3ba48f15304a860ee801457d2d9dd15

    SHA512

    1a3d0983b38e5d99d78503c47fb4cf792f32f98f9c51bd8842fa97302b62850d6c3026169f1da50fffb291319cb811a4c1be8ee64deef35768e803d2ec59ae92

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    159136134f549c5dbbf205b2d742e4a0

    SHA1

    3edd53ade199949cb94a7deb01316221c93e7103

    SHA256

    65e239653c628de44862b508f9d3cf2c639c2a6cee21c0b74e5b90533cc5cd27

    SHA512

    21dacdbea3d3b3003fd9906bec6bf89b25242276fc653bfd7d5d98fb92dbd3526f372e70b8df5a322caf914a1786dd0cb5eab58e991aaed91700500399af55d5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    cdc791db89af175a09c885d463a1d3ed

    SHA1

    c3350ff5513b90251aacfb6a5e74b9e03fe1315d

    SHA256

    ecb5e3a2cce21c76295bff618e221a88452425d187ebd10977d6df649c002bd4

    SHA512

    ec58c55363f1cddbfff901a2424d414c0fc98c218ef2f500818e8bf9589afe1849916568ff0a63c02219777031fbac43af1e89403d5586dec533e8b55c6b28bb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    55d110f32e484543cf66a394adefb138

    SHA1

    ed4abadf7ee27879d6f75216c8c4f2c269909198

    SHA256

    019e32b92bc72bc63ee02b5e45a59e604b92973e7116276cfefe4c3b493cf930

    SHA512

    165e4dface523c970533d9cdd7401384b3a0d67484d0dd6e4dfda118774d12261aa63cea4b51756c23a695a2e7d5806e3fde20578bbae45d6bbeb498b8df6fd5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    80d41a329b79fe0ff5ba617a13d642a5

    SHA1

    f677174d0971e389ce4f8d5164edf69569aae4cf

    SHA256

    9f66843c748a35963126dbc72d9bfe4b0a902679c8f8a4b9ebc2a50f57360753

    SHA512

    6805846a3366af6c65a0237a94fb647bd68cb76e8ccfe0d5da65a9fdb22186fad6321aa76cbf30b2fb64fce61c881c977fd4fe0991669e44c169e93a8298a0c2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4214cfd1d4a12bcd50a155f99bfd214c

    SHA1

    e61c1246c82b7f1662ee81b56bbe66259e7adfda

    SHA256

    7770e02762f9f52bbbb4deea83a2e1fbb28b5df1a00b04d794437a5a940e396d

    SHA512

    f77ec0bbacc352272a5c54be28779844c821d4979443361e4c769cf0f39078b3bc53b80f143230320ae362ca05b8511f8c06268f2e72747ce5407d5cd23bb9ed

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6151d5a84ee33bdcc79c85c2c77364db

    SHA1

    591e3627b4ef3c1552f4cbbec44686265ca81581

    SHA256

    f6551cebb074c26b1c3fb4b877561efc21a4684498166d4440ec69de8b135d80

    SHA512

    bf8093c141fc9f67aadad3864eebfc31bba7b9e914f39e81c50b752c4c03b2254c0d40fc19d0cfaf4354d1338b3c75210b1ff7750f918feff6f4a5e9f8bf8831

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    750a1a07c54c5cb66bc04c16309737ee

    SHA1

    f345f07f3a303f8030334d115416a29850b5c9cf

    SHA256

    15863b0ed3f2c20c035b19b1375aa11135cf8cd014daaca7a44df3577de03ac7

    SHA512

    a247c919107e3666a8b2f84b90bbc3467e4f17b59945448954b801cfb85134900d170b66e951c633cdaa0b48726d4113bb1fc44d7d7f451cde7b5d688d4bf37d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    20e399988cc8a4c2b71b341d33535321

    SHA1

    652d23762fcedde643b92e3b32abb26700fccd9c

    SHA256

    cd24edbfb3fb12a59b5f873551a63b81b11e9471c594af0532163c397f944552

    SHA512

    d857bbc24d986540761423fa1cdd0578dbf77c01e1aa10cc72b856a88019872bf2d0eb71240282c90f11a90859cc796f9297e3c4dfb10c6aef77298995476033

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5bd9b3f0e7db3b9a159eada603cf518c

    SHA1

    140e8c5c8c2737c2d0a7440037c705dd02eafeb3

    SHA256

    36030dde8e877e81b6c2096c859b2cb823d47b855c93846ac22f58c2769621a7

    SHA512

    25de4ed5e888d1ac86a79a2e190d6c2e80391f573f8f5ee59d618bc9facd9a4bff4096f02efa02e49edf8fc9f97f306db164a4b93fd47f1fb4f108f19067a76d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bc756f51220679d44f72772a5ba00bbd

    SHA1

    f1fd08118cad335431c8c2a07f5fcd23108bc9c7

    SHA256

    dfc7317c1aede893a9ecf8e7a3de3f1ae38924ed6ed7793e78ea6d50a3f49dc7

    SHA512

    b1733ebd1704c35783fefbee962c1c21f2d0c7d28962be19e84aa9d344154000b21eab9c43513e6637e463452482fef9e9b65b9b02463f32efb82ae1783a0762

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1a701f48f6ec26152d1e6798c63c776f

    SHA1

    01da256f8bdcb5e7de1e6912dd47c06a394e7773

    SHA256

    b531c1c81269483809772b734f5d7856d10292bc89f740643774042cf6c48994

    SHA512

    fd38880d45f10cc5bdaaa580cb7721acf598eea2f52bf66d1363af203e7330980fd63e2e348e5ee0bc790dfe5da59b696bc64440cf9c67c92a56a0a953172879

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    83ae99d40e50a4837ea385d88666dff6

    SHA1

    42c8c3fdea45f2819cc7ac33ba1557e39f82d0b3

    SHA256

    9c13dfa64dcb3694b9a76b21c05e0a334f2ef2b997b06865d8b54e74c3bd3a2e

    SHA512

    fb370622c6e850c780e309daa8b2f266d84610ccf348cee8a80bfe89b2be0bf038ae034b7e2cdff7afd3897340f8046e9ec11bafa8616ac4b504ee4489978cbc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1899f4adc5bee0bc5449a800b699e250

    SHA1

    d07fb8cbac8633cff7658870b386c603e214ecc5

    SHA256

    93e508ac3656d8ee2de2e95463f4731654a3205b0d2721cb0c067cb717990f10

    SHA512

    ccb373337ee94727a26420207da65c78fb0f0cdfa4b458294e341c9f1db503f26470f4059f5f2cc5a6ff71d4f67dbb6f3fed15cb22c83cfed242e5ecd443c387

  • C:\Users\Admin\AppData\Local\Temp\CabA45D.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\TarA5A8.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • memory/2520-1-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2520-0-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB