Analysis

  • max time kernel
    102s
  • max time network
    25s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 06:52

General

  • Target

    VMM.zip

  • Size

    14.6MB

  • MD5

    06c696dec212fe9a135fcc5a15a9a134

  • SHA1

    84ee0bfdffcca7aeb588fc7900cb859d88ab0b5b

  • SHA256

    5344ad88a5cd21e8c2b396d4c0ff00bf3bb2c09aee63c7eb6f72a86c1a5398f9

  • SHA512

    734fe295516172adb5968fd296e16db6daec73c932860db8b45e843f9eb56e1a00ee2908dd53ec533c27d1aaf3839b0fe0ad0a898b4d24f18eeadcc6b51620d8

  • SSDEEP

    393216:6Lnku9vqgEr3sLmwawkhpNtmAbwFihMXaYFOv0rl66Qwl6hPK/8aeG:6LnjV2sLXBkNtmAEFihoj95XQwMpa/

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\VMM.zip
    1⤵
      PID:3028
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:3068
      • C:\Users\Admin\Desktop\Setup.exe
        "C:\Users\Admin\Desktop\Setup.exe"
        1⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1692
        • C:\Windows\SysWOW64\netsh.exe
          C:\Windows\SysWOW64\netsh.exe
          2⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1640
          • C:\Users\Admin\AppData\Local\Temp\RunDll.exe
            C:\Users\Admin\AppData\Local\Temp\RunDll.exe
            3⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2020
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 200
              4⤵
              • Loads dropped DLL
              • Program crash
              PID:1940

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\3110720c

              Filesize

              4.5MB

              MD5

              9515b07eb3a87b926aad8d9dd64aa454

              SHA1

              3ac6bd117e11a308be46eeb7f9f4637b8a482d5f

              SHA256

              59da866b0475686721a7533c8da1fdb3dfc5c90afc7c08772cad1dc1f358dad8

              SHA512

              10922f541e401b5a52cce8b4ce31524f595cae709154d71d8adc6453959b7187edfe0cd650693b08235788c875c63c39b51271338cf078272a91cd1eb9d1b037

            • \Users\Admin\AppData\Local\Temp\RunDll.exe

              Filesize

              3.6MB

              MD5

              726444379dbb621f5f117a2605425be1

              SHA1

              1700e8c51b39a8000bb41ee8b25940a6962c305b

              SHA256

              a642496f090ca7c54dc57e9ae6f5fe65b3a233dcdf7a2b734f58be23a388b1e9

              SHA512

              28f04eef12ae8d58dd67d956a1bcce0fc3dad579105c4be19432cb902b89977ffb8f9ac85506ce9461582276cd4c5c7be476016c4d9cf3f67bf7f1674c5cd267

            • memory/1640-20-0x0000000072C10000-0x0000000072D84000-memory.dmp

              Filesize

              1.5MB

            • memory/1640-11-0x0000000072C10000-0x0000000072D84000-memory.dmp

              Filesize

              1.5MB

            • memory/1640-15-0x0000000072C10000-0x0000000072D84000-memory.dmp

              Filesize

              1.5MB

            • memory/1640-14-0x0000000072C10000-0x0000000072D84000-memory.dmp

              Filesize

              1.5MB

            • memory/1640-12-0x00000000775C0000-0x0000000077769000-memory.dmp

              Filesize

              1.7MB

            • memory/1692-9-0x0000000001170000-0x0000000001A46000-memory.dmp

              Filesize

              8.8MB

            • memory/1692-6-0x0000000072C10000-0x0000000072D84000-memory.dmp

              Filesize

              1.5MB

            • memory/1692-2-0x00000000775C0000-0x0000000077769000-memory.dmp

              Filesize

              1.7MB

            • memory/1692-7-0x0000000072C10000-0x0000000072D84000-memory.dmp

              Filesize

              1.5MB

            • memory/1692-1-0x0000000072C10000-0x0000000072D84000-memory.dmp

              Filesize

              1.5MB

            • memory/1692-0-0x0000000000180000-0x0000000000181000-memory.dmp

              Filesize

              4KB

            • memory/2020-22-0x00000000775C0000-0x0000000077769000-memory.dmp

              Filesize

              1.7MB

            • memory/2020-23-0x0000000000090000-0x00000000000DD000-memory.dmp

              Filesize

              308KB

            • memory/2020-26-0x0000000000240000-0x00000000005DA000-memory.dmp

              Filesize

              3.6MB

            • memory/2020-27-0x00000000001B0000-0x00000000001B1000-memory.dmp

              Filesize

              4KB

            • memory/2020-33-0x0000000000090000-0x00000000000DD000-memory.dmp

              Filesize

              308KB