Analysis
-
max time kernel
141s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12-02-2024 08:00
General
-
Target
WebCompanionInstaller.exe
-
Size
532KB
-
MD5
5dcb4306382ed9fe9fb9840808ce5710
-
SHA1
e177f95bbed8a53fb8744aff09f5888f358f6425
-
SHA256
b68bb1dd96485e1c6fe59ddd45eda4d2617e4387815979bff7f9c24b27b17908
-
SHA512
f2e42ec5438d1b86ccebc8080248cfe5e5a56c0ccab66bd8a0232b7bee5f7937530b6617fd577ac7eeb70fe7c6b54e0aaaaf77a0353cb05cddf7a9e73c381c06
-
SSDEEP
12288:FG5knZfFKegHf+tCfQNerJnYJNxnj7Ui5lZ/5vPx:FG50ZfFKhGtaQNer9yVHUiHR5x
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WebCompanionInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WebCompanionInstaller.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8902BEE7\WebCompanion-Installer.exe.\WebCompanion-Installer.exe --partner=newwebsite --version=12.1.2.9912⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
428KB
MD52c2a2a2a4fab7ffda89ed084a222de8d
SHA1b68c2669dbf563c21208b00264d532dbe3ff61ae
SHA2569668007f68f82521b89ba74df73e943495f46be993b091d2e83b4c8fd845e193
SHA51218eaf76b4c26c9f670510f06f7a7e35c871ad8044ac8497e4071d32dafa81eb88b204ad79f3e93fc26bb3e8218e3a6045028518826aa3277aa4f4fd09b9c72ae
-
Filesize
427KB
MD5af06ed7f6113aa260aa4a0f8f1d74b30
SHA1ab797fb3d58da5788bf63de6a0becbd8377961ab
SHA2563475db98ab5264d038de9dcebcb3a45eff80b883ec26583f7fc229995768c8db
SHA512766105bfec364b1893e5a2fa74c6c5311b1f708a927c9857bff99c908eb29ded1db2b854e635e63a046223cc9efdeb290e38a87ba6f7012b1c72d173d552cd11
-
Filesize
2KB
MD58c7654010c9d99d059990b145250d091
SHA1df3243adf97d24bd9962f780278f07fa2dc3878f
SHA256a0c723e353a33e8f08b49575f50a73a30ea4b711ac2f050dc36cb812c7bf2d1b
SHA512a7a479b8bd2ec75ef4f1f36a2a552cd90f32b50441132fdcc4c31308c166dc42ace37ec3a0f79cbb3c022ee4d239e0e9f3cc588c189ba75d87b60b5eccf7d5e7
-
Filesize
6KB
MD5bf52d806f18ce25d50129931f2939bc9
SHA173ba4435d26114f6d50e9fc8c4fc683b4d606ec9
SHA25660bd831259853b94998e9228b18b21f2bed462c3acae1c5480e508bd8602b62b
SHA512fb2ba083e540d760a35a23983deb88b14174c4aa6e3e7bc8fb3fdc4f1d02297315adf19925dbd002776f0bf1ea25b5acd61522d15e547f135c2e86d21e24293b
-
Filesize
440KB
-
Filesize
408KB
-
Filesize
320KB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1.0MB
-
Filesize
64KB
-
Filesize
440KB
-
Filesize
128KB
-
Filesize
3.3MB
-
Filesize
6.1MB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
64KB