Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    18-04-2024 06:41

General

  • Target

    02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe

  • Size

    1.1MB

  • MD5

    e0fc3ce37373fb2921c678f48039dcac

  • SHA1

    b7bb47d28579422c11dad710994dde7c3dc724d8

  • SHA256

    02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65

  • SHA512

    d688c1fcb277f1ceaf7467a8e7ee9f6f16593575ba26870838fae520f2598efb779aa3b67b719b155dc9407b9c63dd8a86e5fb157f03842937cc814bf9b56a7b

  • SSDEEP

    12288:17+Cxdvr88vCmgFXD4LDKLuxke/jHjQjd92qsrIWOywbk:175dv4J3xD4DS2ke7D6dgxrzZ

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1192
      • C:\Users\Admin\AppData\Local\Temp\02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe
        "C:\Users\Admin\AppData\Local\Temp\02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2780
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$a4CB9.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2708
          • C:\Users\Admin\AppData\Local\Temp\02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe
            "C:\Users\Admin\AppData\Local\Temp\02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe"
            4⤵
            • Executes dropped EXE
            PID:2872
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2628
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2600
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2492

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        251KB

        MD5

        e9325483409732a224d105e072546fa8

        SHA1

        d23d39592deace449a7bf98427525d34b106b444

        SHA256

        116a778a061a28cd9dd0d3c028fb8982daa3e3ca84e6f33b56f13bc4fa3c1a78

        SHA512

        836d9b24a28b54f734c6d7e9bbb56f301db8a991a53310f9dffd620f76bf798ef1aa8f362b6cd330ec9c146095b6410f9cb174ff54f7b58322f1abd82818db59

      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

        Filesize

        471KB

        MD5

        4cfdb20b04aa239d6f9e83084d5d0a77

        SHA1

        f22863e04cc1fd4435f785993ede165bd8245ac6

        SHA256

        30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9

        SHA512

        35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

      • C:\Users\Admin\AppData\Local\Temp\$$a4CB9.bat

        Filesize

        722B

        MD5

        2c72c5702e95f19f5c30046d40413b58

        SHA1

        6327efcc5cde06be797ee0ab308f171e65ff3729

        SHA256

        46f0b649dfd30ae8a3e9ef0ed6cdaec4f162842d1350f74b317584d3beff8da8

        SHA512

        7e3b1d6614b0338f5a1791cb6dba7fa3d15a7c29c49cf8fb7e199210d025aaab8e4212da7301058189079a4c23ef9fece71f8f8a85b2c27b5cb354787600648e

      • C:\Users\Admin\AppData\Local\Temp\02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe.exe

        Filesize

        1.0MB

        MD5

        f98dde375e9e4c61b54f48893aaeb07b

        SHA1

        f8fff1dd387401c4f4946aca7c524cd210b5f144

        SHA256

        6a1de5fe8f94bc3d7ebdbf8f82a8fedb03d9f9ed16ebfa5883b4e418ce902dc2

        SHA512

        d3dfce3b9bdf553bc043d585c53acbbac69adcce490b48c39408a067512479f52db3916ea9a4b08cbb02df49135b1480416707977f5631fb2a1d21b4c26e7df5

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        8922a4ac9c38bcb52124f9efe7e77593

        SHA1

        d3ed9dd3a8326e982d90926ced067b1a4bb5a663

        SHA256

        fece29ead615f8a7a4a13a36b8415c0fa517cc62954b77ca0c7dedb13a20a0d6

        SHA512

        2e17a7c3247b5c38f89b8cb9b502bd92bbb50966662479e9fd476c207e2e1678d394fc3bb9fd3e06e2b83e9b05a83def8a0539fedeb1842f38f0cdcd01363c5c

      • F:\$RECYCLE.BIN\S-1-5-21-778096762-2241304387-192235952-1000\_desktop.ini

        Filesize

        9B

        MD5

        72b7e38c6ba037d117f32b55c07b1a9c

        SHA1

        35e2435e512e17ca2be885e17d75913f06b90361

        SHA256

        e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6

        SHA512

        2bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a

      • memory/1192-30-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

        Filesize

        4KB

      • memory/2628-39-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2628-32-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2628-21-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2628-46-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2628-92-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2628-98-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2628-260-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2628-1851-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2628-3311-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2780-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2780-40-0x0000000000220000-0x0000000000254000-memory.dmp

        Filesize

        208KB

      • memory/2780-16-0x0000000000220000-0x0000000000254000-memory.dmp

        Filesize

        208KB

      • memory/2780-15-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB