Analysis

  • max time kernel
    119s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/03/2024, 22:39

General

  • Target

    Cat.Goes.Fishing.v13.11.2019/_Redist/dxwebsetup.exe

  • Size

    281KB

  • MD5

    fd6057b33e15a553ddc5d9873723ce8f

  • SHA1

    f90efb623b5abea70af63c470daa8674444fb1df

  • SHA256

    111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288

  • SHA512

    d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d

  • SSDEEP

    6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 7 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\_Redist\dxwebsetup.exe
    "C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\_Redist\dxwebsetup.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1592
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:1724

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll

          Filesize

          87KB

          MD5

          0a23038ea472ffc938366ef4099d6635

          SHA1

          6499d741776dc4a446c22ea11085842155b34176

          SHA256

          8f2c455c9271290dcde2f68589cf825f9134beecb7e8b7e2ecbcabeab792280a

          SHA512

          dcc1c2ea86fd3a7870cd0369fa42f63d493895c546dcdd492ee19079a0d0696d689bbfe7b686d4fa549841896a54e673fc4581b80783d7aa255dfad765b9dc88

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dll

          Filesize

          1.7MB

          MD5

          7672509436485121135c2a0e30b9e9ff

          SHA1

          f557022a9f42fe1303078093e389f21fb693c959

          SHA256

          d7ea3cf1b9b639010005e503877026597a743d1068ae6a453ce77cc202796fea

          SHA512

          e46ff68c4a532017f8ab15b1e46565508f6285b72c7a1cbe964ed5e75320c8e14587d01fee61b3966f43636bfe74cebd21f7665b4a726281e771cf9230e69863

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

          Filesize

          384KB

          MD5

          95af51a930889c82630553e5d9d24f4b

          SHA1

          d24fe70a2152b09d1b85166443e24d2d61defdf5

          SHA256

          b8c3d2b050e3541e4072d8522a63319ce53f48ce7c975d2b2f389db91df36865

          SHA512

          faeafbeea9c190b33b5354ec9998cb285911cecf78c69acbe11a2de253e939494e5d72b8036e849f27358d3db64a81f395f81ec3f34810a9f74db37f9edca4cd

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

          Filesize

          223KB

          MD5

          69f2ccb12f81ec470df9d387b8c6bbb6

          SHA1

          2d8837824951e146eb9428b781936cfb605ce05b

          SHA256

          0d2d950d7ac0b622b3d65a616fbb09875cd1c26d01eff31f07d000a61d6706b2

          SHA512

          f93e3172b709cdb848a63a3d7909d0b43979960068e86045207d1884742e513e9613fabe1be402bcfe34fa46235e6a7d682bf9cb18fe5fbdb2dc404a7815e1e4

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf

          Filesize

          477B

          MD5

          ad8982eaa02c7ad4d7cdcbc248caa941

          SHA1

          4ccd8e038d73a5361d754c7598ed238fc040d16b

          SHA256

          d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00

          SHA512

          5c805d78bafff06c36b5df6286709ddf2d36808280f92e62dc4c285edd9176195a764d5cf0bb000da53ca8bbf66ddd61d852e4259e3113f6529e2d7bdbdd6e28

        • \Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

          Filesize

          487KB

          MD5

          eaa6b5ee297982a6a396354814006761

          SHA1

          780bf9a61c080a335e8712c5544fcbf9c7bdcd72

          SHA256

          d298fd82a39b2385a742ba1992466e081bea0f49e19ece6b2c87c7c262e1fcee

          SHA512

          ebdc887b6b334b7560f85ab2ebd29dc1f3a2dedac7f70042594f2a9bc128b6fca0a0e7704318ed69b7acf097e962533b3ce07713ef80e8acfe09374c13302999

        • \Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

          Filesize

          256KB

          MD5

          938638d0da26178572066d3f62ddd15c

          SHA1

          9941160e7d06e97460aba020e29b42e52bec04e3

          SHA256

          1a529633246ee8977411af4128738ee7389d8576e100f86fbf590a336e0f8d68

          SHA512

          934c943250737c737e2f268632300bb923070518f4b7fa321c6d39392fa3cfce032d5a41d54de6ad40529b96e3699fe78251d98f79b102e38a70e49e7af5e1af

        • \Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

          Filesize

          192KB

          MD5

          ba4a4b82dd8bd438959b8542d66161ad

          SHA1

          51d91e28ace38ea7d183498edd9031dabb6f18bb

          SHA256

          82f87b955cbe426c3b6302bb2de938057166af6a0db02a3a191d17814fecefb8

          SHA512

          72689ceba03390eaa0ca228d7885d15531fe57e9c4fdbe619bdd33777b3b79b7f828a81c11b60f16248cf64bff3086c41df04f25e7f13815fd2d3af971025e88