b62c5f76b05543c1f980ccd972666e8fb769b9fb58fc6a0142d9044fea7d40d8

Analysis

max time kernel
203s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 01:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Set@up#!Files-P@ssw0rD__~2402~_/Set-up.exe
Size 3.3MB
Sample240224-bz3tkadh65
SHA256 e3cb1b8edb969533e9299c4169b12df17a01d7516df943b486a785c986ceda30
MD5 55076afc8f8de2df8f91fb2742bcda61
SHA1 c848bb01e859163b08ce4f58994b3d814dfdf700
SHA512 70bf3d76b86b28aa4209a51469a4b2161c4253313849217b5e1267cb17f6279235b9ed18cd975aa48227401b48887f594b3be149531750638091afc51a425d26
SSDEEP 98304:WNdaWWhvT90MSGmHUkC+UH9txcv0HGM62OQy:WNdaWWhvZ0MhmHUkxUH9tx1HA
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2744 set thread context of 2580	2744	Set-up.exe	28

Loads dropped DLL 7 IoCs

pid	Process
2580	netsh.exe
2428	fm.exe
2360	WerFault.exe
2360	WerFault.exe
2360	WerFault.exe
2360	WerFault.exe
2360	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2360	2428	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2744	Set-up.exe
2744	Set-up.exe
2580	netsh.exe
2580	netsh.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2744	Set-up.exe
2580	netsh.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2580	2744	Set-up.exe	28
PID 2744 wrote to memory of 2580	2744	Set-up.exe	28
PID 2744 wrote to memory of 2580	2744	Set-up.exe	28
PID 2744 wrote to memory of 2580	2744	Set-up.exe	28
PID 2744 wrote to memory of 2580	2744	Set-up.exe	28
PID 2580 wrote to memory of 2428	2580	netsh.exe	30
PID 2580 wrote to memory of 2428	2580	netsh.exe	30
PID 2580 wrote to memory of 2428	2580	netsh.exe	30
PID 2580 wrote to memory of 2428	2580	netsh.exe	30
PID 2580 wrote to memory of 2428	2580	netsh.exe	30
PID 2580 wrote to memory of 2428	2580	netsh.exe	30
PID 2580 wrote to memory of 2428	2580	netsh.exe	30
PID 2580 wrote to memory of 2428	2580	netsh.exe	30
PID 2428 wrote to memory of 2360	2428	fm.exe	31
PID 2428 wrote to memory of 2360	2428	fm.exe	31
PID 2428 wrote to memory of 2360	2428	fm.exe	31
PID 2428 wrote to memory of 2360	2428	fm.exe	31
PID 2580 wrote to memory of 2428	2580	netsh.exe	30

C:\Users\Admin\AppData\Local\Temp\Set@up#!Files-P@ssw0rD__~2402~_\Set-up.exe
"C:\Users\Admin\AppData\Local\Temp\Set@up#!Files-P@ssw0rD__~2402~_\Set-up.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\SysWOW64\netsh.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Users\Admin\AppData\Local\Temp\fm.exe
    C:\Users\Admin\AppData\Local\Temp\fm.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 212
      4⤵
      Loads dropped DLL
      Program crash
      PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

88c900c4

Path C:\Users\Admin\AppData\Local\Temp\88c900c4
Size 1.9MB
SHA256 7a1b546719e0d5cc8d05400283d4fdbfc2a33940b0344f642556f1d32034ef6a
MD5 e0a643f9cce419ec02a23712c8e01d91
SHA1 82ab55d1bc667532a11dd1454416b83eb595cbff
SHA512 15d57ed99dd1fdaec592e434901f28108457abdbf4fa2dff38ab01a54846a0b65fb799184bcfbf28f08d93ccbf97b881be7c7ff2c571813a7bbb81cfe7703cb3
SSDEEP 49152:Kj/zAGNYVujMJaGbEMfDVa4HzqYT8/HLvaml:cz5GVXa8tfDSYALyml
MD5 SHA1 SHA512 SSDEEP

Submit Download

fm.exe

Path C:\Users\Admin\AppData\Local\Temp\fm.exe
Size 994KB
SHA256 6e599490e164505af796569dce30e18218b179b2b791fe69764892b3ed3e7478
MD5 de0ea31558536ca7e3164c3cd4578bf5
SHA1 5cc890c3ade653bb1ed1e53dabb0410602ee52df
SHA512 c47299cd5f3b4961f423c2ca1fef5a33eb4b0f63dc232af70ef9da39f6f82270406061dd543461de7e47abd1244e26d6190de6035120211b27d4c23f97a25aba
SSDEEP 24576:eZwu3kI1OqRsSLJG+tr4mr08m5GV1eFSxdRMfJs:w/3DUqRLJGLQwGVQSxdRMfJs
MD5 SHA1 SHA512 SSDEEP

Submit Download

fm.exe

Path \Users\Admin\AppData\Local\Temp\fm.exe
Size 64KB
SHA256 fcd8f543d98065f02c86f45857ec59df5c22320cc880df07821b869037730d11
MD5 dfeec0dedde0b31aedb4ca3dde9a1471
SHA1 8069c555ff935678edff94a53d7363a4ffad2631
SHA512 4963604064f99036f988d5c9fd2dff0072152a5a4748eccec242af48c864a35f5e0c17f8455b68841cdcfd5d53f5f44c7c2b5f43220c6f343e14b3d8ca59ca88
SSDEEP 1536:CkbhtdmuoRKFfshrVQz6A4cSDsB8jIyvMKjsniRyV:PQuoRKilV9cFmj3MEEicV
MD5 SHA1 SHA512 SSDEEP

Submit Download

fm.exe

Path \Users\Admin\AppData\Local\Temp\fm.exe
Size 252KB
SHA256 de77952ea8ba63e85930a3928997354f6e773b051d791198d65f884e54baf6a5
MD5 e01afc572ba1ae40119b26908ec485b5
SHA1 451d3909ca3e6254a3b66775dee88e59f4d6231d
SHA512 6d7454b8632b69ebbc44cd55f8c6f39c29c838d97128d8885e6a98358a2bcac0db006c68e58367d73809f4d0004c9746244f89e1569c9f181347cccd4dc06b16
SSDEEP 6144:P2Kg9Omj3MEPtg3ynrNatlcV9P6gFs45NydO5D:eZwutdk4b
MD5 SHA1 SHA512 SSDEEP

Submit Download

fm.exe

Path \Users\Admin\AppData\Local\Temp\fm.exe
Size 832KB
SHA256 687e7c64087a976d8e44858a392e3d006a05d52a9a616547d48b6248e9589878
MD5 d9318dfc89439d317afd432c7d548e42
SHA1 bfbc074d6d197d3c09aa9e92c310fd1f75f164ec
SHA512 f07b07152f319dfc50726b85a23e80e7826fc3e12f2ac78b4da9c28377faa350b33945162fe5b93291f8273bb1af29c09fa9edf1327a3ed92c847ec66ba9ddd7
SSDEEP 12288:eZwutdk49U3RUYbkOqRs0zLPJGp+l73ptOU4zuitY7Qwr08mBnRpT6Q:eZwu3kI1OqRsSLJG+tr4mr08m5r
MD5 SHA1 SHA512 SSDEEP

Submit Download

fm.exe

Path \Users\Admin\AppData\Local\Temp\fm.exe
Size 260KB
SHA256 29e1418dcb81cfe154567d53b234d658fe573ed2e3c412cf4b1c2e2975076f40
MD5 00d9e86c071e459247cdf51676d4cfcf
SHA1 375c4ce7baecc273d027cf5468f05c7d7be74959
SHA512 3aa4adb55b20611c1fcb820091ed9571db97e60645322a929eb0a5d746f043c4c590f1de255250758e03a07d8d2ea3e43fa9c8dac160bc30952059c85ba612f0
SSDEEP 6144:P2Kg9Omj3MEPtg3ynrNatlcV9P6gFs45NydO5nVS:eZwutdk49S
MD5 SHA1 SHA512 SSDEEP

Submit Download

fm.exe

Path \Users\Admin\AppData\Local\Temp\fm.exe
Size 181KB
SHA256 a84072fb8d40eda4247877d1bd239c787fa73e1180c3240d78ece31240c3fe94
MD5 f519e4babcf1dca0b9f594eca6eb20a7
SHA1 fc6fafdaa46522627447384659fc881eb33fe0be
SHA512 f8694a082481ab8ee9a1413719b816c9045d8dfe3bc5311f22f24146789692bcc20ebab7bc2ce85cd9d4f1bedaa9ab0917e4607a4bafc5d9c29415d02aeba31e
SSDEEP 3072:PQuoRKilV9cFmj3MEEicsHtBSdM8lyt9rNathTcV9w6c/gwwsrsb:P2Kg9Omj3MEPtg3ynrNatlcV9P6gFso
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2428-51-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2428-44-0x0000000000B90000-0x0000000000C8B000-memory.dmp

Download

memory/2428-43-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2428-42-0x0000000077830000-0x00000000779D9000-memory.dmp

Download

memory/2428-49-0x0000000000270000-0x0000000000271000-memory.dmp

Download

memory/2428-52-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2580-32-0x0000000077830000-0x00000000779D9000-memory.dmp

Download

memory/2580-40-0x0000000074D90000-0x0000000074F04000-memory.dmp

Download

memory/2580-20-0x0000000074D90000-0x0000000074F04000-memory.dmp

Download

memory/2580-35-0x0000000074D90000-0x0000000074F04000-memory.dmp

Download

memory/2580-34-0x0000000074D90000-0x0000000074F04000-memory.dmp

Download

memory/2744-24-0x000000006C370000-0x000000006C4B3000-memory.dmp

Download

memory/2744-21-0x000000006E010000-0x000000006E02C000-memory.dmp

Download

memory/2744-27-0x000000006DBC0000-0x000000006DBCF000-memory.dmp

Download

memory/2744-29-0x000000006DBE0000-0x000000006DBED000-memory.dmp

Download

memory/2744-31-0x000000006DAB0000-0x000000006DACE000-memory.dmp

Download

memory/2744-30-0x000000006DBD0000-0x000000006DBDE000-memory.dmp

Download

memory/2744-28-0x000000006DBF0000-0x000000006DBFE000-memory.dmp

Download

memory/2744-26-0x000000006DC50000-0x000000006DC5D000-memory.dmp

Download

memory/2744-25-0x000000006DC20000-0x000000006DC48000-memory.dmp

Download

memory/2744-0-0x0000000074D90000-0x0000000074F04000-memory.dmp

Download

memory/2744-23-0x000000006DDC0000-0x000000006DDE0000-memory.dmp

Download

memory/2744-22-0x000000006DFD0000-0x000000006DFF3000-memory.dmp

Download

memory/2744-18-0x0000000000400000-0x0000000000787000-memory.dmp

Download

memory/2744-16-0x0000000074D90000-0x0000000074F04000-memory.dmp

Download

memory/2744-15-0x0000000074D90000-0x0000000074F04000-memory.dmp

Download

memory/2744-1-0x0000000077830000-0x00000000779D9000-memory.dmp

Download