Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/03/2024, 23:44

General

  • Target

    cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe

  • Size

    216KB

  • MD5

    000e3b49539c7a05bd04ce3626f8cd19

  • SHA1

    f2455b37eb2bc1dd2d89e8efd16874803cbf2903

  • SHA256

    cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048

  • SHA512

    b0693268653881b9bfe105445b40a9e2d1f7cb20b4b1e391d16a9c856101b4432c7064685cf75592d8678c3f9bb101a9624f6b802c3398b7e3faa2f3ee2374bc

  • SSDEEP

    6144:H2fIfrt3+TetonBi3QxRy4g09ICSnqf9uSUgkxtpsaPjK/bEoK828fwAoEn+MM:H2Irt3+TetonBi3QxRwfnqf9uSUgkxtZ

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 53 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe
    "C:\Users\Admin\AppData\Local\Temp\cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Users\Admin\houweut.exe
      "C:\Users\Admin\houweut.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2536

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\houweut.exe

          Filesize

          216KB

          MD5

          72761e610e9fd9ef0272bd3a32b02611

          SHA1

          df7dc8f9ec92716d24f607daa3de52436c55b0bf

          SHA256

          e32dd7963e866abfce4ab126b8a56cd09107f6de8025fc099dd654956b8fb4af

          SHA512

          5e5db105729adc161702a61268a4331e9de839bcd94da7219064091b7136ae953c0d91fad53ceeb46594fc3187c354a36f503cb2d725b85bdc9dc9db112bc2a7