Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2024 13:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9989b4f4c5a1960279eb9d2eaf6d2097.exe
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
9989b4f4c5a1960279eb9d2eaf6d2097.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
9989b4f4c5a1960279eb9d2eaf6d2097.exe
-
Size
19KB
-
MD5
9989b4f4c5a1960279eb9d2eaf6d2097
-
SHA1
16d2139fae08c0c7ec020f87315055e5d2d57261
-
SHA256
35445e039141a449b773978546b21318bc765f9b9dd5ad51db1fcc6e033b91de
-
SHA512
3be9c1fdb34c169013e49dba08149f68db3977ac8ad566c78c287e34d0afd96bd8de7184015e04f261c0b2e7221337f4c8642e031174f6afc59893c2a8585a77
-
SSDEEP
384:mJiWnkWnLmW/GOuODGk0p9A8Gyraamx95aJ/1Sztrrv:egW9L0p9AumxfaMrr
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 9989b4f4c5a1960279eb9d2eaf6d2097.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\melove = "C:\\Windows\\system32\\dream.exe" 9989b4f4c5a1960279eb9d2eaf6d2097.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\dream = "C:\\Windows\\system32\\dream.exe" 9989b4f4c5a1960279eb9d2eaf6d2097.exe -
Loads dropped DLL 1 IoCs
pid Process 4296 svchost.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\i: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\o: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\z: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\s: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\w: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\h: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\j: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\k: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\m: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\p: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\r: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\y: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\l: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\u: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\v: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\x: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\g: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\n: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\q: 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened (read-only) \??\t: 9989b4f4c5a1960279eb9d2eaf6d2097.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\c:\autorun.inf 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened for modification \??\c:\autorun.inf 9989b4f4c5a1960279eb9d2eaf6d2097.exe File created \??\f:\autorun.inf 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened for modification \??\f:\autorun.inf 9989b4f4c5a1960279eb9d2eaf6d2097.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\plmmsbl.dll 9989b4f4c5a1960279eb9d2eaf6d2097.exe File opened for modification C:\Windows\SysWOW64\plmmsbl.dll 9989b4f4c5a1960279eb9d2eaf6d2097.exe File created C:\Windows\SysWOW64\dream.exe 9989b4f4c5a1960279eb9d2eaf6d2097.exe File created C:\Windows\SysWOW64\1.inf 9989b4f4c5a1960279eb9d2eaf6d2097.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 804 set thread context of 4296 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 86 -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 804 wrote to memory of 2380 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 84 PID 804 wrote to memory of 2380 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 84 PID 804 wrote to memory of 2380 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 84 PID 804 wrote to memory of 4296 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 86 PID 804 wrote to memory of 4296 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 86 PID 804 wrote to memory of 4296 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 86 PID 804 wrote to memory of 4296 804 9989b4f4c5a1960279eb9d2eaf6d2097.exe 86 PID 2380 wrote to memory of 1180 2380 cmd.exe 87 PID 2380 wrote to memory of 1180 2380 cmd.exe 87 PID 2380 wrote to memory of 1180 2380 cmd.exe 87 PID 1180 wrote to memory of 1788 1180 net.exe 88 PID 1180 wrote to memory of 1788 1180 net.exe 88 PID 1180 wrote to memory of 1788 1180 net.exe 88 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer 9989b4f4c5a1960279eb9d2eaf6d2097.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9989b4f4c5a1960279eb9d2eaf6d2097.exe"C:\Users\Admin\AppData\Local\Temp\9989b4f4c5a1960279eb9d2eaf6d2097.exe"1⤵
- Adds policy Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:804 -
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop sharedaccess2⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\net.exenet stop sharedaccess3⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵PID:1788
-
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Loads dropped DLL
PID:4296
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5e0e12856ca90be7f5ab8dfc0f0313078
SHA1cc5accf48b8e6c2fd39d1f800229cdbb54305518
SHA25681ec3e3c98e5f0af0dca21b9f08f2be445b46df2ca2354eaf3523bddcb125619
SHA512162c56367dca2291117f2391951970273969518b0db2bbc5d51c458173a8028c88d9dfd93aef01ed05b369f953e2953cc6be252daeb17556dbc33e5383900fa6
-
Filesize
87B
MD548167078ad3c858e3b7ff5397d5cc450
SHA1df8a4961b4cf5462ca6de00d4ffbe28675896663
SHA2563e972502a1707fe3494ceeb9d1432f9e54ecbab5631c7355e4de6ca1b7bb4279
SHA51224a16f36778e5fb99867ac25147248ba069233237b619782c886c6f5d2a95de91c8e2bb553b3f50a5bc78c7058b81f9807fdc46e1db4b746bcc1d74f89c57869
-
Filesize
19KB
MD59989b4f4c5a1960279eb9d2eaf6d2097
SHA116d2139fae08c0c7ec020f87315055e5d2d57261
SHA25635445e039141a449b773978546b21318bc765f9b9dd5ad51db1fcc6e033b91de
SHA5123be9c1fdb34c169013e49dba08149f68db3977ac8ad566c78c287e34d0afd96bd8de7184015e04f261c0b2e7221337f4c8642e031174f6afc59893c2a8585a77