Analysis

  • max time kernel
    215s
  • max time network
    215s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20-04-2024 04:25

General

  • Target

    mm3.exe

  • Size

    381KB

  • MD5

    35a27d088cd5be278629fae37d464182

  • SHA1

    d5a291fadead1f2a0cf35082012fe6f4bf22a3ab

  • SHA256

    4a75f2db1dbd3c1218bb9994b7e1c690c4edd4e0c1a675de8d2a127611173e69

  • SHA512

    eb0be3026321864bd5bcf53b88dc951711d8c0b4bcbd46800b90ca5116a56dba22452530e29f3ccbbcc43d943bdefc8ed8ca2d31ba2e7e5f0e594f74adba4ab5

  • SSDEEP

    6144:Th3idhONY259BH1DzJ5PzVNtGgc+F9TBd096cTKAsLEbqqbd+VWM8AHiKn9SlXNA:Th3iXPw9Tc6kVXMHHLEf8l7

Score
10/10

Malware Config

Signatures

  • UAC bypass 3 TTPs 3 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 8 IoCs
  • Obfuscated with Agile.Net obfuscator 8 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • System policy modification 1 TTPs 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mm3.exe
    "C:\Users\Admin\AppData\Local\Temp\mm3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\76C5.tmp\76C6.tmp\76C7.vbs //Nologo
      2⤵
      • UAC bypass
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2596
      • C:\Users\Admin\AppData\Local\Temp\76C5.tmp\eulascr.exe
        "C:\Users\Admin\AppData\Local\Temp\76C5.tmp\eulascr.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2536
  • C:\Windows\system32\verclsid.exe
    "C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
    1⤵
      PID:1676
    • C:\Users\Admin\AppData\Local\Temp\mm3.exe
      "C:\Users\Admin\AppData\Local\Temp\mm3.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1032
      • C:\Windows\system32\wscript.exe
        "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\79F.tmp\7AF.tmp\7B0.vbs //Nologo
        2⤵
        • UAC bypass
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1796
        • C:\Users\Admin\AppData\Local\Temp\79F.tmp\eulascr.exe
          "C:\Users\Admin\AppData\Local\Temp\79F.tmp\eulascr.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1656
    • C:\Windows\system32\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "1192" "3472"
      1⤵
        PID:2776
      • C:\Users\Admin\AppData\Local\Temp\mm3.exe
        "C:\Users\Admin\AppData\Local\Temp\mm3.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:3004
        • C:\Windows\system32\wscript.exe
          "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\8298.tmp\8299.tmp\829A.vbs //Nologo
          2⤵
          • UAC bypass
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2504
          • C:\Users\Admin\AppData\Local\Temp\8298.tmp\eulascr.exe
            "C:\Users\Admin\AppData\Local\Temp\8298.tmp\eulascr.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:2136
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x490
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:376
      • C:\Users\Admin\AppData\Local\Temp\8298.tmp\eulascr.exe
        "C:\Users\Admin\AppData\Local\Temp\8298.tmp\eulascr.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:860
      • C:\Windows\system32\wermgr.exe
        "C:\Windows\system32\wermgr.exe" "-outproc" "1192" "3972"
        1⤵
          PID:1572
        • C:\Users\Admin\AppData\Local\Temp\8298.tmp\eulascr.exe
          "C:\Users\Admin\AppData\Local\Temp\8298.tmp\eulascr.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2516
        • C:\Windows\system32\msinfo32.exe
          "C:\Windows\system32\msinfo32.exe"
          1⤵
          • Suspicious behavior: GetForegroundWindowSpam
          PID:2544

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\76C5.tmp\76C6.tmp\76C7.vbs

          Filesize

          352B

          MD5

          3b8696ecbb737aad2a763c4eaf62c247

          SHA1

          4a2d7a2d61d3f4c414b4e5d2933cd404b8f126e5

          SHA256

          ce95f7eea8b303bc23cfd6e41748ad4e7b5e0f0f1d3bdf390eadb1e354915569

          SHA512

          713d9697b892b9dd892537e8a01eab8d0265ebf64867c8beecf7a744321257c2a5c11d4de18fcb486bb69f199422ce3cab8b6afdbe880481c47b06ba8f335beb

        • C:\Users\Admin\AppData\Local\Temp\76C5.tmp\eulascr.exe

          Filesize

          143KB

          MD5

          8b1c352450e480d9320fce5e6f2c8713

          SHA1

          d6bd88bf33de7c5d4e68b233c37cc1540c97bd3a

          SHA256

          2c343174231b55e463ca044d19d47bd5842793c15954583eb340bfd95628516e

          SHA512

          2d8e43b1021da08ed1bf5aff110159e6bc10478102c024371302ccfce595e77fd76794658617b5b52f9a50190db250c1ba486d247d9cd69e4732a768edbb4cbc

        • C:\Users\Admin\AppData\Local\Temp\8298.tmp\AgileDotNet.VMRuntime.dll

          Filesize

          49KB

          MD5

          266373fadd81120baeae3504e1654a5a

          SHA1

          1a66e205c7b0ba5cd235f35c0f2ea5f52fdea249

          SHA256

          0798779dc944ba73c5a9ce4b8781d79f5dd7b5f49e4e8ef75020de665bad8ccb

          SHA512

          12da48e8770dc511685fb5d843f73ef6b7e6747af021f4ba87494bba0ec341a6d7d3704f2501e2ad26822675e83fd2877467342aacdb2fd718e526dafd10506b

        • \Users\Admin\AppData\Local\Temp\5a530dfd-bc51-4992-a05d-f09d41a331d4\AgileDotNetRT64.dll

          Filesize

          75KB

          MD5

          42b2c266e49a3acd346b91e3b0e638c0

          SHA1

          2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

          SHA256

          adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

          SHA512

          770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

        • memory/860-56-0x0000000000E30000-0x0000000000E5A000-memory.dmp

          Filesize

          168KB

        • memory/860-60-0x00000000022A0000-0x0000000002320000-memory.dmp

          Filesize

          512KB

        • memory/860-58-0x000007FEF4BA0000-0x000007FEF4CCC000-memory.dmp

          Filesize

          1.2MB

        • memory/860-59-0x000007FEF4DD0000-0x000007FEF57BC000-memory.dmp

          Filesize

          9.9MB

        • memory/860-61-0x00000000022A0000-0x0000000002320000-memory.dmp

          Filesize

          512KB

        • memory/860-62-0x000007FEF4DD0000-0x000007FEF57BC000-memory.dmp

          Filesize

          9.9MB

        • memory/1656-28-0x00000000012E0000-0x000000000130A000-memory.dmp

          Filesize

          168KB

        • memory/1656-32-0x000007FEF4DD0000-0x000007FEF4EFC000-memory.dmp

          Filesize

          1.2MB

        • memory/1656-31-0x000007FEF5000000-0x000007FEF59EC000-memory.dmp

          Filesize

          9.9MB

        • memory/1656-33-0x000000001B210000-0x000000001B290000-memory.dmp

          Filesize

          512KB

        • memory/1656-34-0x000000001B210000-0x000000001B290000-memory.dmp

          Filesize

          512KB

        • memory/1656-35-0x000007FEF5000000-0x000007FEF59EC000-memory.dmp

          Filesize

          9.9MB

        • memory/2136-47-0x0000000001300000-0x000000000132A000-memory.dmp

          Filesize

          168KB

        • memory/2136-48-0x000007FEF4A80000-0x000007FEF546C000-memory.dmp

          Filesize

          9.9MB

        • memory/2136-51-0x000007FEF58C0000-0x000007FEF59EC000-memory.dmp

          Filesize

          1.2MB

        • memory/2136-50-0x000000001B1D0000-0x000000001B250000-memory.dmp

          Filesize

          512KB

        • memory/2136-52-0x000000001B1D0000-0x000000001B250000-memory.dmp

          Filesize

          512KB

        • memory/2136-53-0x000007FEF4A80000-0x000007FEF546C000-memory.dmp

          Filesize

          9.9MB

        • memory/2516-67-0x000007FEF4D30000-0x000007FEF571C000-memory.dmp

          Filesize

          9.9MB

        • memory/2516-64-0x0000000000DA0000-0x0000000000DCA000-memory.dmp

          Filesize

          168KB

        • memory/2516-66-0x000007FEF4B00000-0x000007FEF4C2C000-memory.dmp

          Filesize

          1.2MB

        • memory/2516-68-0x000000001ACC0000-0x000000001AD40000-memory.dmp

          Filesize

          512KB

        • memory/2516-69-0x000000001ACC0000-0x000000001AD40000-memory.dmp

          Filesize

          512KB

        • memory/2516-70-0x000007FEF4D30000-0x000007FEF571C000-memory.dmp

          Filesize

          9.9MB

        • memory/2536-18-0x000000001AB70000-0x000000001ABF0000-memory.dmp

          Filesize

          512KB

        • memory/2536-17-0x000007FEF43B0000-0x000007FEF44DC000-memory.dmp

          Filesize

          1.2MB

        • memory/2536-10-0x000000001AB70000-0x000000001ABF0000-memory.dmp

          Filesize

          512KB

        • memory/2536-9-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

          Filesize

          9.9MB

        • memory/2536-8-0x0000000000230000-0x000000000025A000-memory.dmp

          Filesize

          168KB

        • memory/2536-19-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

          Filesize

          9.9MB