962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19

Analysis

max time kernel
146s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe
Size

8.7MB
MD5

b3af772173e18e4f2db30ced2509046d
SHA1

269b3814195634e902dd7f1447b61dafec031d9c
SHA256

962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19
SHA512

675981c62ac1c542622f0eaff91954f775d53cdf5e78d1c7b4205e1d31ef1c17f9b17c9b495570ffda904bc07238f401737a1721af1817d9ab0e06db7563cd92
SSDEEP

196608:DtZougnAUVJH1WRclH/TKCrVZ4vUqWAptiODug+082w:DtZougn8RoH/TKCBCcqNtiau7r

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
656	962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe

Loads dropped DLL 2 IoCs

pid	Process
656	962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe
656	962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
656	962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe
656	962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
656	962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe
656	962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
656	962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe
656	962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe
656	962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe
656	962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 656	3256	962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe	94
PID 3256 wrote to memory of 656	3256	962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe	94
PID 3256 wrote to memory of 656	3256	962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe	94

C:\Users\Admin\AppData\Local\Temp\962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe
"C:\Users\Admin\AppData\Local\Temp\962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Users\Admin\AppData\Local\Temp\~ACCAStore\962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19\962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe
  "C:\Users\Admin\AppData\Local\Temp\~ACCAStore\962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19\962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe" "C:\Users\Admin\AppData\Local\Temp\" {1ECC418F-F354-4A02-9808-70D08D7AF70F}
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~ACCAStoreLog\PriMus.aclog

Filesize
966B

MD5
8c17f2c50bbfee2fb2745cc23b311c0a

SHA1
329c7b3776453420b05362ac15b53094538f6934

SHA256
67251d0ca141db8b8f8d1284dfa82963a8154ce8b7586d6fb5c1e3a2bf7cd6be

SHA512
d482d512b8c00e89cc223371fd0210ce44831d1c748ce3afc9e0a02490cc61632887568dee6ca6f526aa0c6a8e502db31082675e65b71656427d6523e8b90680

Download Submit
C:\Users\Admin\AppData\Local\Temp\~ACCAStore\962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19\962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19.exe

Filesize
8.7MB

MD5
b3af772173e18e4f2db30ced2509046d

SHA1
269b3814195634e902dd7f1447b61dafec031d9c

SHA256
962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19

SHA512
675981c62ac1c542622f0eaff91954f775d53cdf5e78d1c7b4205e1d31ef1c17f9b17c9b495570ffda904bc07238f401737a1721af1817d9ab0e06db7563cd92

Download Submit
C:\Users\Admin\AppData\Local\Temp\~ACCAStore\962928200a5b740d9531a26c3cecfcd1ba3635b4f47771d32ecdcbfab5a90c19\FUppSetupLib.dll

Filesize
3.8MB

MD5
15d7aa4118a21a61db21a703f9df1681

SHA1
59bda5a4025249874035530256289a6554bb218f

SHA256
cb3f3da6021ce226fa61d126df75a5cc5aa2114c42d024a5fa0547340c3191f5

SHA512
2409a37a98abbcf77bd220feaa563c3ac1022fbe8334ddb78220cd3075fc468b956bdf565edb4bf2626a282061999db17032dbada25605ea4dade243ae9d8c14

Download Submit
memory/656-16-0x0000000002980000-0x0000000002981000-memory.dmp

Filesize
4KB

Download
memory/656-92-0x0000000006120000-0x000000000656F000-memory.dmp

Filesize
4.3MB

Download
memory/656-96-0x0000000006C50000-0x0000000006C60000-memory.dmp

Filesize
64KB

Download
memory/656-99-0x00000000067F0000-0x00000000067F1000-memory.dmp

Filesize
4KB

Download
memory/656-100-0x0000000000400000-0x0000000000CC1000-memory.dmp

Filesize
8.8MB

Download
memory/656-102-0x0000000002980000-0x0000000002981000-memory.dmp

Filesize
4KB

Download
memory/656-103-0x0000000006C50000-0x0000000006C60000-memory.dmp

Filesize
64KB

Download
memory/656-105-0x00000000067F0000-0x00000000067F1000-memory.dmp

Filesize
4KB

Download
memory/3256-0-0x0000000002D10000-0x0000000002D11000-memory.dmp

Filesize
4KB

Download
memory/3256-86-0x0000000000400000-0x0000000000CC1000-memory.dmp

Filesize
8.8MB

Download
memory/3256-15-0x0000000000400000-0x0000000000CC1000-memory.dmp

Filesize
8.8MB

Download