Analysis
-
max time kernel
140s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 19:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
461340.exe
Resource
win7-20240220-en
7 signatures
150 seconds
General
-
Target
461340.exe
-
Size
415KB
-
MD5
b5bda46e3f9832d656edd1216f56b04d
-
SHA1
0bad37e244d3a50cc1b0fb2585e9e504b73224b6
-
SHA256
4e333b4b742ee952e26a136abaf144f98299f0e099b69bb2d8fa74bd145df8c5
-
SHA512
fd10b0be3e9948da0d73de25dabdd6765c48fec48a373ec0aa8c1c2b2a9b892f893410ba2ef0bee7ee1dfd481d22da8878a14cf8052f75c3a4f5371e690052e4
-
SSDEEP
6144:FROHyaR7iKZqFtj9Lbk11eHHOqamMCt8KJ6c:PKyatiwqDd0yImMeHQc
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1384 461340.exe 1384 461340.exe 2436 461340.exe 2436 461340.exe 3756 oobecabinet.exe 3756 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe 1336 oobecabinet.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2436 461340.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1384 wrote to memory of 2436 1384 461340.exe 90 PID 1384 wrote to memory of 2436 1384 461340.exe 90 PID 1384 wrote to memory of 2436 1384 461340.exe 90 PID 3756 wrote to memory of 1336 3756 oobecabinet.exe 92 PID 3756 wrote to memory of 1336 3756 oobecabinet.exe 92 PID 3756 wrote to memory of 1336 3756 oobecabinet.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\461340.exe"C:\Users\Admin\AppData\Local\Temp\461340.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\461340.exe"C:\Users\Admin\AppData\Local\Temp\461340.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2436
-
-
C:\Windows\SysWOW64\oobecabinet.exe"C:\Windows\SysWOW64\oobecabinet.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\oobecabinet.exe"C:\Windows\SysWOW64\oobecabinet.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵PID:4760