aee69ef9040e902b7a6639d7594df47e0e73625143a671583db8b85be525a3e5

Resubmissions

02/03/2024, 22:38

240302-2kwptaae3710

02/03/2024, 22:34

240302-2g86qsad9610

Analysis

max time kernel
1801s
max time network
1802s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fake AV/FileFixPro/FFProInstall.exe
Size 455KB
Sample240302-2kwptaae37
SHA256 25f1979680c26601156c6ba3ad931b555b3f1ce82bf3546f8bf7d6241d3962d8
MD5 d70754abc051edb0248b7287834808e2
SHA1 9266f535d621c52e7603c1f30be7f67025663003
SHA512 4be8b38129532429c84835197c329ff69d74a567d00f0fa88319656c531bc3af6326fa24a5692a1ebbe9bc4005a53a52aeb818507c773055b76a4e33c34482ea
SSDEEP 12288:qmkOy5ws5qyKxg3Ismvo2gYcfygnXqD+k3TW:qfOy50Jx+IsV2mfXw+7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3752	is-SEC5D.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 3752	1608	FFProInstall.exe	96
PID 1608 wrote to memory of 3752	1608	FFProInstall.exe	96
PID 1608 wrote to memory of 3752	1608	FFProInstall.exe	96

C:\Users\Admin\AppData\Local\Temp\Fake AV\FileFixPro\FFProInstall.exe
"C:\Users\Admin\AppData\Local\Temp\Fake AV\FileFixPro\FFProInstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Users\Admin\AppData\Local\Temp\is-KD30O.tmp\is-SEC5D.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KD30O.tmp\is-SEC5D.tmp" /SL4 $7005C "C:\Users\Admin\AppData\Local\Temp\Fake AV\FileFixPro\FFProInstall.exe" 232353 52224
  2⤵
  - Executes dropped EXE
  PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=708 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

is-SEC5D.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-KD30O.tmp\is-SEC5D.tmp
Size 648KB
SHA256 bee86b674d51b4e21822e44f9408a69d60e282e39f5897888df334c74d840aa4
MD5 0360b1d1195775766b2e78a7b463f658
SHA1 8e4b2b1b6d1e4446c979b0cea7db6db7eee21610
SHA512 23103b4457952091848f171f5c20351dd55ce1bce209da21c1b6792d6e0b13476a104698c31ad744df2df39408110d73f84b61e627bbb6d1d2a461db4370597d
SSDEEP 12288:XeuHnWgyrgVu4rPy37WzH0A6uaF4JNK3NFRvYRajlxp:uuHcrgVxrPy37WzH0A6uwkNKMKlxp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1608-0-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1608-2-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1608-13-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/3752-7-0x00000000006B0000-0x00000000006B1000-memory.dmp

Download

memory/3752-14-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/3752-17-0x00000000006B0000-0x00000000006B1000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads