a4ea700b81162fffa25eea3aefe0d4118601ae8acd0123f08e487c4c8bc0ad84

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fr.exe
Size

335KB
MD5

642c6b02eaaeb1d68a822c14af3f6bab
SHA1

1f2eefedb9ad59d046725b20246d10e7462f9813
SHA256

b973e7f93d2181b7435107ae5b548c091f79a1cda264899f5d500e44df5489a5
SHA512

0dc14379ef493020286ae40d906b3f2c905e3a99113b530451b12209a6357c178a89598ae0535cfdc6b3f17ae15daa2a791dea76acb9685661b170740a0ca1f1
SSDEEP

6144:Ig6O9ZgZcxDjl1+hcBkGLkdw8KYNqyIWdXqjphplvMmyejD9woDx2ntO12Q:IIZgWVChc2G0wzsq9gX2PUXe/9vDxKtY

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk	fr.exe

Executes dropped EXE 1 IoCs

pid	Process
2148	SmartClock.exe

Loads dropped DLL 3 IoCs

pid	Process
2868	fr.exe
2868	fr.exe
2868	fr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2148	SmartClock.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2148	2868	fr.exe	28
PID 2868 wrote to memory of 2148	2868	fr.exe	28
PID 2868 wrote to memory of 2148	2868	fr.exe	28
PID 2868 wrote to memory of 2148	2868	fr.exe	28

C:\Users\Admin\AppData\Local\Temp\fr.exe
"C:\Users\Admin\AppData\Local\Temp\fr.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
  "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe

Filesize
335KB

MD5
642c6b02eaaeb1d68a822c14af3f6bab

SHA1
1f2eefedb9ad59d046725b20246d10e7462f9813

SHA256
b973e7f93d2181b7435107ae5b548c091f79a1cda264899f5d500e44df5489a5

SHA512
0dc14379ef493020286ae40d906b3f2c905e3a99113b530451b12209a6357c178a89598ae0535cfdc6b3f17ae15daa2a791dea76acb9685661b170740a0ca1f1

Download Submit
memory/2148-19-0x00000000009A0000-0x0000000000AA0000-memory.dmp

Filesize
1024KB

Download
memory/2148-20-0x0000000000400000-0x000000000090A000-memory.dmp

Filesize
5.0MB

Download
memory/2148-23-0x00000000009A0000-0x0000000000AA0000-memory.dmp

Filesize
1024KB

Download
memory/2868-1-0x0000000000250000-0x0000000000350000-memory.dmp

Filesize
1024KB

Download
memory/2868-2-0x00000000003C0000-0x00000000003E6000-memory.dmp

Filesize
152KB

Download
memory/2868-4-0x0000000000400000-0x000000000090A000-memory.dmp

Filesize
5.0MB

Download
memory/2868-16-0x0000000000400000-0x000000000090A000-memory.dmp

Filesize
5.0MB

Download
memory/2868-17-0x00000000003C0000-0x00000000003E6000-memory.dmp

Filesize
152KB

Download