Overview
overview
7Static
static
3InstMsiA.exe
windows7-x64
7InstMsiA.exe
windows10-2004-x64
7InstMsiW.exe
windows7-x64
7InstMsiW.exe
windows10-2004-x64
7MSIcn.msi
windows7-x64
6MSIcn.msi
windows10-2004-x64
6MSIen.msi
windows7-x64
6MSIen.msi
windows10-2004-x64
6MSIfr.msi
windows7-x64
6MSIfr.msi
windows10-2004-x64
6MSIge.msi
windows7-x64
6MSIge.msi
windows10-2004-x64
6MSIit.msi
windows7-x64
6MSIit.msi
windows10-2004-x64
6MSIjp.msi
windows7-x64
6MSIjp.msi
windows10-2004-x64
6MSIko.msi
windows7-x64
6MSIko.msi
windows10-2004-x64
6MSIsp.msi
windows7-x64
6MSIsp.msi
windows10-2004-x64
6MSItw.msi
windows7-x64
6MSItw.msi
windows10-2004-x64
6_0200BEB4E...2D.dll
windows7-x64
1_0200BEB4E...2D.dll
windows10-2004-x64
1_07F57D9CE...47.exe
windows7-x64
1_07F57D9CE...47.exe
windows10-2004-x64
1_1B4DC5A2E...9B.dll
windows7-x64
1_1B4DC5A2E...9B.dll
windows10-2004-x64
1_2797A4C85...0E.exe
windows7-x64
1_2797A4C85...0E.exe
windows10-2004-x64
1_29F1BB284...4.html
windows7-x64
1_29F1BB284...4.html
windows10-2004-x64
1Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-02-2024 02:45
Static task
static1
Behavioral task
behavioral1
Sample
InstMsiA.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
InstMsiA.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
InstMsiW.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
InstMsiW.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
MSIcn.msi
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
MSIcn.msi
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
MSIen.msi
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
MSIen.msi
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
MSIfr.msi
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
MSIfr.msi
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
MSIge.msi
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
MSIge.msi
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
MSIit.msi
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
MSIit.msi
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
MSIjp.msi
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
MSIjp.msi
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
MSIko.msi
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
MSIko.msi
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
MSIsp.msi
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
MSIsp.msi
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
MSItw.msi
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
MSItw.msi
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
_0200BEB4EFB34AC8AF68134E35F0622D.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
_0200BEB4EFB34AC8AF68134E35F0622D.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
_07F57D9CEFDA42F78AFA5E0E12E5A347.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
_07F57D9CEFDA42F78AFA5E0E12E5A347.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
_1B4DC5A2E06842A2AF67D90F083EA79B.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
_1B4DC5A2E06842A2AF67D90F083EA79B.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
_2797A4C85C6646FB9F5D7699281AD20E.exe
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
_2797A4C85C6646FB9F5D7699281AD20E.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
_29F1BB2847B84F499F5F20825A00ABC4.html
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
_29F1BB2847B84F499F5F20825A00ABC4.html
Resource
win10v2004-20240226-en
General
-
Target
_0200BEB4EFB34AC8AF68134E35F0622D.dll
-
Size
12KB
-
MD5
f8a6018193be629b8ea4c5d7b2452b70
-
SHA1
a0d3257b9edfa8769cda28339f2ac7b7db14744c
-
SHA256
12e750559bd14b3940831377adc0deb0204d6d14fa1f2d0458b9f84d4a8f5a59
-
SHA512
a185450f0f3dc7e5f323f91c0d1b53709009645a60f2961c31406e247d7a0225b01cc03cfb117248eb52a07eaaafe141ff47f3e2630eef707023417d490daa42
-
SSDEEP
192:PqN6aAxZSY5jFXD4t/Gw/4H0ia+mvJaeIS1TzDA7ZU/iAPPA6+jtQhRwdxM6MJ53:Po6qYZFXsHwHZuvJJvA7ZU/5Y6dqBS3
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3620 wrote to memory of 4072 3620 rundll32.exe 94 PID 3620 wrote to memory of 4072 3620 rundll32.exe 94 PID 3620 wrote to memory of 4072 3620 rundll32.exe 94
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\_0200BEB4EFB34AC8AF68134E35F0622D.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\_0200BEB4EFB34AC8AF68134E35F0622D.dll,#12⤵PID:4072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵PID:4500