ab5fd5b542977645488e296770bbb76137d4893ecb9eddaf3e492bce5f5aa6ce

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4.exe
Size 356KB
Sample240310-d37yssbc74
SHA256 eebd782f6612da1133b0e130bf751578de50cadfd0268b98ce4a31815edc636c
MD5 63298373ec0b3d06cd3b6e9cffd4ab79
SHA1 2f6482a9d617e7d0bc21e78258cb08677de52e69
SHA512 3948a304b82c055e37082948668c11b39cb3c47adc729cb2d7018fde5b78441f84420b101122360906f03c5299eb543082cc55513bfc84513042416faa5276a1
SSDEEP 6144:wcNwDljd8nQCbKRgAs2EPwGTfJ7ahjJFKVV1:qBd8nQ9RgAs2237ahjGV
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk	4.exe

Executes dropped EXE 1 IoCs

pid	Process
2744	SmartClock.exe

Loads dropped DLL 3 IoCs

pid	Process
2192	4.exe
2192	4.exe
2192	4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2744	SmartClock.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2744	2192	4.exe	28
PID 2192 wrote to memory of 2744	2192	4.exe	28
PID 2192 wrote to memory of 2744	2192	4.exe	28
PID 2192 wrote to memory of 2744	2192	4.exe	28

C:\Users\Admin\AppData\Local\Temp\4.exe
"C:\Users\Admin\AppData\Local\Temp\4.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
  "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SmartClock.exe

Path \Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
Size 356KB
SHA256 eebd782f6612da1133b0e130bf751578de50cadfd0268b98ce4a31815edc636c
MD5 63298373ec0b3d06cd3b6e9cffd4ab79
SHA1 2f6482a9d617e7d0bc21e78258cb08677de52e69
SHA512 3948a304b82c055e37082948668c11b39cb3c47adc729cb2d7018fde5b78441f84420b101122360906f03c5299eb543082cc55513bfc84513042416faa5276a1
SSDEEP 6144:wcNwDljd8nQCbKRgAs2EPwGTfJ7ahjJFKVV1:qBd8nQ9RgAs2237ahjGV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2192-2-0x0000000003350000-0x0000000003450000-memory.dmp

Download

memory/2192-15-0x0000000000400000-0x0000000003255000-memory.dmp

Download

memory/2192-16-0x0000000000220000-0x0000000000246000-memory.dmp

Download

memory/2192-13-0x0000000000400000-0x0000000003255000-memory.dmp

Download

memory/2744-18-0x00000000033B0000-0x00000000034B0000-memory.dmp

Download

memory/2744-19-0x0000000000400000-0x0000000003255000-memory.dmp

Download

memory/2744-22-0x00000000033B0000-0x00000000034B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads