Analysis
-
max time kernel
140s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 19:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
461340.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
General
-
Target
461340.exe
-
Size
415KB
-
MD5
b5bda46e3f9832d656edd1216f56b04d
-
SHA1
0bad37e244d3a50cc1b0fb2585e9e504b73224b6
-
SHA256
4e333b4b742ee952e26a136abaf144f98299f0e099b69bb2d8fa74bd145df8c5
-
SHA512
fd10b0be3e9948da0d73de25dabdd6765c48fec48a373ec0aa8c1c2b2a9b892f893410ba2ef0bee7ee1dfd481d22da8878a14cf8052f75c3a4f5371e690052e4
-
SSDEEP
6144:FROHyaR7iKZqFtj9Lbk11eHHOqamMCt8KJ6c:PKyatiwqDd0yImMeHQc
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
461340.exe461340.exeoobecabinet.exeoobecabinet.exepid process 1384 461340.exe 1384 461340.exe 2436 461340.exe 2436 461340.exe 3756 oobecabinet.exe 3756 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
461340.exepid process 2436 461340.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
461340.exeoobecabinet.exedescription pid process target process PID 1384 wrote to memory of 2436 1384 461340.exe 461340.exe PID 1384 wrote to memory of 2436 1384 461340.exe 461340.exe PID 1384 wrote to memory of 2436 1384 461340.exe 461340.exe PID 3756 wrote to memory of 1336 3756 oobecabinet.exe oobecabinet.exe PID 3756 wrote to memory of 1336 3756 oobecabinet.exe oobecabinet.exe PID 3756 wrote to memory of 1336 3756 oobecabinet.exe oobecabinet.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\461340.exe"C:\Users\Admin\AppData\Local\Temp\461340.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\461340.exe"C:\Users\Admin\AppData\Local\Temp\461340.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2436
-
C:\Windows\SysWOW64\oobecabinet.exe"C:\Windows\SysWOW64\oobecabinet.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\oobecabinet.exe"C:\Windows\SysWOW64\oobecabinet.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1336
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵PID:4760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1336-26-0x0000000001230000-0x0000000001246000-memory.dmpFilesize
88KB
-
memory/1336-30-0x0000000001230000-0x0000000001246000-memory.dmpFilesize
88KB
-
memory/1384-16-0x0000000000A90000-0x0000000000AA6000-memory.dmpFilesize
88KB
-
memory/1384-2-0x0000000000AB0000-0x0000000000AC6000-memory.dmpFilesize
88KB
-
memory/1384-6-0x0000000000AB0000-0x0000000000AC6000-memory.dmpFilesize
88KB
-
memory/1384-7-0x00000000006A0000-0x00000000006B0000-memory.dmpFilesize
64KB
-
memory/1384-1-0x0000000000A90000-0x0000000000AA6000-memory.dmpFilesize
88KB
-
memory/2436-9-0x0000000000A40000-0x0000000000A56000-memory.dmpFilesize
88KB
-
memory/2436-15-0x0000000000A80000-0x0000000000A90000-memory.dmpFilesize
64KB
-
memory/2436-10-0x0000000000A60000-0x0000000000A76000-memory.dmpFilesize
88KB
-
memory/2436-14-0x0000000000A60000-0x0000000000A76000-memory.dmpFilesize
88KB
-
memory/2436-32-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2436-33-0x0000000000A40000-0x0000000000A56000-memory.dmpFilesize
88KB
-
memory/3756-18-0x0000000000600000-0x0000000000616000-memory.dmpFilesize
88KB
-
memory/3756-23-0x0000000000640000-0x0000000000656000-memory.dmpFilesize
88KB
-
memory/3756-24-0x0000000000620000-0x0000000000630000-memory.dmpFilesize
64KB
-
memory/3756-19-0x0000000000640000-0x0000000000656000-memory.dmpFilesize
88KB
-
memory/3756-31-0x0000000000600000-0x0000000000616000-memory.dmpFilesize
88KB