Analysis

  • max time kernel
    99s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 05:30

General

  • Target

    Device/HarddiskVolume1/Desktop/Downloads/Programs/BitTorrent.exe

  • Size

    5.0MB

  • MD5

    b8c24a19ae1706e4baf0253b8f33abe3

  • SHA1

    a6eb472bb97ddec488203467d10bc26e86dc8e53

  • SHA256

    3c855659332b10f81efb7574d83624a30db08c15fe3927cee1dbdb2c523d3554

  • SHA512

    2c18eea5f88c2cf0fcceacfa8df78d50d59cdcf9d21369c4cffea43a4e020f31a0ad27394ff22572585c2db7708d8c10c5b7e74000d83c1f543a3608190e5b68

  • SSDEEP

    98304:EG5QgXqF9Eqwxx968O4TZ6PGeM2z2bw3cih8wbCGU3Zg0M9am4LzTWifkBG5Qn8:EG5nfqqtO4TTomiawbC7pgWzTWig78

Score
4/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Executes dropped EXE 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume1\Desktop\Downloads\Programs\BitTorrent.exe
    "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume1\Desktop\Downloads\Programs\BitTorrent.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4052
    • C:\Users\Admin\AppData\Local\Temp\7zS4DF8F317\GenericSetup.exe
      .\GenericSetup.exe
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zS4DF8F317\GenericSetup.exe

    Filesize

    10.0MB

    MD5

    305b424f87d4b6f08eacdf47f8eefcd1

    SHA1

    9622b76a56443fddead8f4996d5f1b4e05fa0b93

    SHA256

    48a61875fe1ef52b1f375b1e95f38193da7bccfa0a54cd283687b4ccce59fced

    SHA512

    b5d53d066693b02ae39d3c2e0095a53aa311e2cf0a239a43ebd2d8bc7e481cdb26d0819c577f60433f0a23b7141b8a9ed94d1fd8dce6e9e3fffa441eef4bd7a3

  • C:\Users\Admin\AppData\Local\Temp\7zS4DF8F317\GenericSetup.exe.config

    Filesize

    814B

    MD5

    fd63ee3928edd99afc5bdf17e4f1e7b6

    SHA1

    1b40433b064215ea6c001332c2ffa093b1177875

    SHA256

    2a2ddbdc4600e829ad756fd5e84a79c0401fa846ad4f2f2fb235b410e82434a9

    SHA512

    1925cde90ee84db1e5c15fa774ee5f10fa368948df7643259b03599ad58cfce9d409fd2cd752ff4cbca60b4bbe92b184ff92a0c6e8b78849c4497d38266bd3b4

  • memory/4472-23-0x0000000074670000-0x0000000074E20000-memory.dmp

    Filesize

    7.7MB

  • memory/4472-22-0x0000000000BE0000-0x00000000015E8000-memory.dmp

    Filesize

    10.0MB

  • memory/4472-24-0x0000000005FA0000-0x0000000005FB0000-memory.dmp

    Filesize

    64KB

  • memory/4472-25-0x0000000006090000-0x000000000676C000-memory.dmp

    Filesize

    6.9MB

  • memory/4472-26-0x0000000005F70000-0x0000000005F78000-memory.dmp

    Filesize

    32KB

  • memory/4472-27-0x0000000005FF0000-0x0000000006018000-memory.dmp

    Filesize

    160KB

  • memory/4472-28-0x0000000006880000-0x00000000068AC000-memory.dmp

    Filesize

    176KB

  • memory/4472-29-0x0000000006C20000-0x0000000006C86000-memory.dmp

    Filesize

    408KB

  • memory/4472-30-0x00000000072C0000-0x00000000072D2000-memory.dmp

    Filesize

    72KB

  • memory/4472-31-0x0000000074670000-0x0000000074E20000-memory.dmp

    Filesize

    7.7MB

  • memory/4472-32-0x0000000005FA0000-0x0000000005FB0000-memory.dmp

    Filesize

    64KB

  • memory/4472-36-0x0000000007C20000-0x0000000007C9C000-memory.dmp

    Filesize

    496KB

  • memory/4472-38-0x0000000008550000-0x00000000088A4000-memory.dmp

    Filesize

    3.3MB

  • memory/4472-39-0x0000000008FC0000-0x0000000009564000-memory.dmp

    Filesize

    5.6MB

  • memory/4472-54-0x0000000008C70000-0x0000000008D02000-memory.dmp

    Filesize

    584KB