Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 18:10

General

  • Target

    Benefits-Signature-RequestsPlan#241205.com.exe

  • Size

    318KB

  • MD5

    46e978f5dee2d39687269d77e44df3cf

  • SHA1

    f15c27a41a2e7e78b07df29c687da3e70e813e66

  • SHA256

    5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d

  • SHA512

    81c38dd8ed41e0fc6b8a83ea536ca568c10cf1ee994edd0ef2acd00e85f45db85830f68e78e28679036d6e950617e4405e1a24fb293bf3e8fabc885f92ca9d19

  • SSDEEP

    6144:A9X0GAbjQDWEofo891UrIq5ezWQn1SGse/yuIW7Nrw0zRRb4iUH13T:G0t/voK1UwzWQ13setIWRw0NZlo13T

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Benefits-Signature-RequestsPlan#241205.com.exe
    "C:\Users\Admin\AppData\Local\Temp\Benefits-Signature-RequestsPlan#241205.com.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 528
      2⤵
      • Program crash
      PID:2620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Desktop\polres.lnk

    Filesize

    1KB

    MD5

    242ac576ce8aedd49414aaa5e598f880

    SHA1

    10b2f091d661fe70baddab0976bdd528abbcfcb4

    SHA256

    3e49da24d8a66fc4c5eb28ccec510ad4f3ce9d4c8d510fb039741589e4822fc7

    SHA512

    2d84edf88b3a49fe4e5d7da96d3537eedd9bca43cd203cc7dfebf81ed878dbe0b77dd27764b03db883a4251692fd6fe986cbfc5830429b66381a1a9e05bfeb98

  • \Users\Admin\AppData\Local\Temp\nstD6A.tmp\System.dll

    Filesize

    11KB

    MD5

    4ca4fd3fbefa2f6e87e6e9ee87d1c0b3

    SHA1

    7cdbeb5ff2b14b86af04e075d0ca651183ea5df4

    SHA256

    d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57

    SHA512

    cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8

  • \Users\Admin\AppData\Local\Temp\nstD6A.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    035bdb470a6807313bd005bd98341ffc

    SHA1

    5017d1e5a23f1c64594f737e6fccd519729c3b3e

    SHA256

    26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27

    SHA512

    f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05

  • \Users\Admin\AppData\Local\Temp\nstD6A.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    eb2c74e05b30b29887b3219f4ea3fdab

    SHA1

    91173d46b34e7bae57acabdbd239111b5bcc4d9e

    SHA256

    d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed

    SHA512

    1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae

  • memory/2316-380-0x0000000005670000-0x00000000082EF000-memory.dmp

    Filesize

    44.5MB

  • memory/2316-381-0x0000000005670000-0x00000000082EF000-memory.dmp

    Filesize

    44.5MB