Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16/03/2024, 02:30

General

  • Target

    cce17fc715e827e34df7acdde700f0bb.exe

  • Size

    1.5MB

  • MD5

    cce17fc715e827e34df7acdde700f0bb

  • SHA1

    f14b553b7e9dec5816e225f4fb18a589c693581c

  • SHA256

    8a39762c6ab09162c4922c489573ca7317a6c7673fecf082ef91bc77b1574643

  • SHA512

    c969474250103a686ad430fe6a2907cef07f385224b3bcdffd6dbc8ffd1410e206bedf757875394eec00e048ba76487d69644f4aef00a8a76019e8e123d72eab

  • SSDEEP

    24576:LHAIvPp6Wdrb10hJaothZ2/T6FBBjNPI5lqkfZSkHR82b10hJaothZ2/T6FBBT:JvP4Wh/ofqg4/ofp

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cce17fc715e827e34df7acdde700f0bb.exe
    "C:\Users\Admin\AppData\Local\Temp\cce17fc715e827e34df7acdde700f0bb.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Users\Admin\AppData\Local\Temp\cce17fc715e827e34df7acdde700f0bb.exe
      C:\Users\Admin\AppData\Local\Temp\cce17fc715e827e34df7acdde700f0bb.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    67KB

    MD5

    753df6889fd7410a2e9fe333da83a429

    SHA1

    3c425f16e8267186061dd48ac1c77c122962456e

    SHA256

    b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

    SHA512

    9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

  • C:\Users\Admin\AppData\Local\Temp\Tar7CC5.tmp

    Filesize

    175KB

    MD5

    dd73cead4b93366cf3465c8cd32e2796

    SHA1

    74546226dfe9ceb8184651e920d1dbfb432b314e

    SHA256

    a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

    SHA512

    ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

  • C:\Users\Admin\AppData\Local\Temp\cce17fc715e827e34df7acdde700f0bb.exe

    Filesize

    799KB

    MD5

    3a7eee855dfc3e9d3f312da7f6101eb3

    SHA1

    c55dc9b57982ec796e36e729dca76d7961d8750b

    SHA256

    5629d51213ee10938e3dab1eb4fd0eda5905047768a527a086829ac47a9948ce

    SHA512

    88ec3d9ae27120f6ec190790d5ae6f6f0972bcbf13cacd2c247dcfe2077b9eabccf6db0f26b38838b6d0329f5ac158460d07273992735606d929b0821a55f5e5

  • \Users\Admin\AppData\Local\Temp\cce17fc715e827e34df7acdde700f0bb.exe

    Filesize

    1.3MB

    MD5

    0c74157bf6b56caaa772c92bea08ca77

    SHA1

    771ad73141d1fb16cca495dac986d5f4a73fe957

    SHA256

    9ec51494539fe7bf97187c15d97c9e1516dd195760d89125c3a6efb97903bcb4

    SHA512

    8730983884f70936ec41338a2c2e1da55448addba1e91b852750a1b25d53e60e8322d60349e191fb2f3ccfa1ec47a0fc69ee2668145027afe266b19dcad143cd

  • memory/2208-2-0x0000000000210000-0x0000000000276000-memory.dmp

    Filesize

    408KB

  • memory/2208-1-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2208-14-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2208-0-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/2208-12-0x0000000001550000-0x00000000015B6000-memory.dmp

    Filesize

    408KB

  • memory/2724-16-0x0000000000370000-0x00000000003D6000-memory.dmp

    Filesize

    408KB

  • memory/2724-23-0x0000000002CA0000-0x0000000002CFF000-memory.dmp

    Filesize

    380KB

  • memory/2724-22-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2724-80-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2724-85-0x000000000EA00000-0x000000000EA3C000-memory.dmp

    Filesize

    240KB

  • memory/2724-86-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB