Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 06:52

General

  • Target

    Setup.exe

  • Size

    8.7MB

  • MD5

    480f8cf600f5509595b8418c6534caf2

  • SHA1

    dc13258ebb83bdf956523d751f67e29d6e4cf77e

  • SHA256

    6d8905ec0b1dfdc0a10d1cce40714ddd73205a09ad390b933ddbecdcf06a4cf2

  • SHA512

    f0bd99f68d59e80538fb276945d0f383394cb94a35c6d12ebd3e87061222249f78b9ca75716b33e36b66842b97c71149612111fcb6a8a3bc3a97635b03934aaf

  • SSDEEP

    196608:Ywdj1UbkCchr3rlFE8GCWhKUzGZ3gRTFHnBz58//o:Yw91Ubkxhr3rlFHWhKUzGZ3gRTFhzi/o

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2832
    • C:\Windows\SysWOW64\netsh.exe
      C:\Windows\SysWOW64\netsh.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1384
      • C:\Users\Admin\AppData\Local\Temp\RunDll.exe
        C:\Users\Admin\AppData\Local\Temp\RunDll.exe
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2596
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 196
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1296

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\9717d2b2

          Filesize

          4.5MB

          MD5

          c6749be44fda45f59400565e96a438c4

          SHA1

          aa38e13ce70d83c896eb3166b2deb424533cd702

          SHA256

          1b448489f265bcf01e9afe71cc26a1309de46d25ee2d8ee8938554ef7a6b65ff

          SHA512

          41278ca24b2401a0db17bc99e2c13e951a09b90369d17ddf193e070e2c0ab7205f136c4e5757261f85b2321ddf715e86d7ad0cb7687073ca348adee071e365cb

        • \Users\Admin\AppData\Local\Temp\RunDll.exe

          Filesize

          3.6MB

          MD5

          726444379dbb621f5f117a2605425be1

          SHA1

          1700e8c51b39a8000bb41ee8b25940a6962c305b

          SHA256

          a642496f090ca7c54dc57e9ae6f5fe65b3a233dcdf7a2b734f58be23a388b1e9

          SHA512

          28f04eef12ae8d58dd67d956a1bcce0fc3dad579105c4be19432cb902b89977ffb8f9ac85506ce9461582276cd4c5c7be476016c4d9cf3f67bf7f1674c5cd267

        • memory/1384-20-0x0000000072960000-0x0000000072AD4000-memory.dmp

          Filesize

          1.5MB

        • memory/1384-11-0x0000000072960000-0x0000000072AD4000-memory.dmp

          Filesize

          1.5MB

        • memory/1384-12-0x00000000770C0000-0x0000000077269000-memory.dmp

          Filesize

          1.7MB

        • memory/1384-15-0x0000000072960000-0x0000000072AD4000-memory.dmp

          Filesize

          1.5MB

        • memory/1384-14-0x0000000072960000-0x0000000072AD4000-memory.dmp

          Filesize

          1.5MB

        • memory/2596-22-0x00000000770C0000-0x0000000077269000-memory.dmp

          Filesize

          1.7MB

        • memory/2596-34-0x0000000000090000-0x00000000000DD000-memory.dmp

          Filesize

          308KB

        • memory/2596-33-0x0000000000090000-0x00000000000DD000-memory.dmp

          Filesize

          308KB

        • memory/2596-31-0x00000000001C0000-0x00000000001C1000-memory.dmp

          Filesize

          4KB

        • memory/2596-30-0x0000000000A60000-0x0000000000DFA000-memory.dmp

          Filesize

          3.6MB

        • memory/2596-23-0x0000000000090000-0x00000000000DD000-memory.dmp

          Filesize

          308KB

        • memory/2832-9-0x0000000000BB0000-0x0000000001486000-memory.dmp

          Filesize

          8.8MB

        • memory/2832-0-0x0000000000290000-0x0000000000291000-memory.dmp

          Filesize

          4KB

        • memory/2832-1-0x0000000072960000-0x0000000072AD4000-memory.dmp

          Filesize

          1.5MB

        • memory/2832-6-0x0000000072960000-0x0000000072AD4000-memory.dmp

          Filesize

          1.5MB

        • memory/2832-2-0x00000000770C0000-0x0000000077269000-memory.dmp

          Filesize

          1.7MB

        • memory/2832-7-0x0000000072960000-0x0000000072AD4000-memory.dmp

          Filesize

          1.5MB