Analysis

  • max time kernel
    140s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    12-03-2024 16:47

General

  • Target

    $TEMP/BroomSetup.exe

  • Size

    1.7MB

  • MD5

    eee5ddcffbed16222cac0a1b4e2e466e

  • SHA1

    28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5

  • SHA256

    2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54

  • SHA512

    8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc

  • SSDEEP

    49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMP\BroomSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMP\BroomSetup.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2968
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:2588
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\$TEMP\Updater.exe'" /sc minute /mo 30 /F
          3⤵
          • Creates scheduled task(s)
          PID:2592

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Temp\Task.bat

      Filesize

      134B

      MD5

      fe4c7277dd275839d983fe9e120c320d

      SHA1

      c42dc104bb9b4a6ed80af7ce99762954116305d7

      SHA256

      fe6f6d8f8785486a597976f1cc9587618d3ebda7814548182bd41233d8cd31e7

      SHA512

      29fdb916f5f8a10a53f9bf3c6dfb6bdf73564b9e0a17a52e3c1a9b0457390d259bb0152bc40b7e7fadfa733d282f9c14e00f499a5bcbfe82c2b37eb90de861bf

    • memory/1888-1-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB

    • memory/1888-0-0x0000000000400000-0x0000000000930000-memory.dmp

      Filesize

      5.2MB

    • memory/1888-10-0x0000000000400000-0x0000000000930000-memory.dmp

      Filesize

      5.2MB

    • memory/1888-12-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB