Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 00:36

General

  • Target

    04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe

  • Size

    64KB

  • MD5

    648d6dc6ebff924db713bc75e30249de

  • SHA1

    875be1687f0280f9284c3fcd60c2a7be5d2692ef

  • SHA256

    04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca

  • SHA512

    3af59397a2e556ca08afd453a632e2cfea71210caa3c1cf65e2a6a8f898353de87afb9e4248b956cca6cc6b62bd94cba72d5c5e0a93bdc621ebf6524981c3eff

  • SSDEEP

    1536:Kz3SHmLKarIpYCriw+d9bHrkT5gUHz7FxtJ:akF3pxrBkfkT5xHzD

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1208
      • C:\Users\Admin\AppData\Local\Temp\04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe
        "C:\Users\Admin\AppData\Local\Temp\04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2972
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$a146B.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2912
          • C:\Users\Admin\AppData\Local\Temp\04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe
            "C:\Users\Admin\AppData\Local\Temp\04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe"
            4⤵
            • Executes dropped EXE
            PID:2708
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2916
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2648
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2928

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

              Filesize

              252KB

              MD5

              6735a16d04dfac1f92f7ab89c64b071f

              SHA1

              502eaa755229fc80b186faf533cf827c322bab66

              SHA256

              3a071105a38c10f7fa17dcc239337e999b57b68f4bd05c168b2548956931383c

              SHA512

              bfe01bb853f187f68d0fe64da2da4cf1d26c0491eb3183a7c7d5e905a1b1c3db90b84c1cdadb00c7d7f733ef32a9153dfa73de5259d9f1c3d401633145b420a8

            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

              Filesize

              472KB

              MD5

              88eb1bca8c399bc3f46e99cdde2f047e

              SHA1

              55fafbceb011e1af2edced978686a90971bd95f2

              SHA256

              42fd78c05bc240d4ded16ac974f17c336f6ae3a1814d548021c48a942cc30428

              SHA512

              149d4de0c024e25a13a7bb17471e6f48391d4f26b1c8388672320eed1c255f84219ad7b72bbebc531ae558d5192dd4bb6d0dddd6c65a45300c8e8348a4fb3728

            • C:\Users\Admin\AppData\Local\Temp\$$a146B.bat

              Filesize

              722B

              MD5

              091eec9a0c065312de2e104302e1f895

              SHA1

              f0fd73d055aed07715dbb13f30b3160f80625aa5

              SHA256

              61142a6d91a7937443d6acfe4f161feab9a4e409b13cc5626f049f723739453b

              SHA512

              465beb2771858aad2cba20a905e104f2b3605ec5d8d5173e2f5dd9135906890bfd231a744247a509cf5609fcaa30b8d137f58e6a151ddc1b44b1802d561cec18

            • C:\Users\Admin\AppData\Local\Temp\04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe.exe

              Filesize

              36KB

              MD5

              9f498971cbe636662f3d210747d619e1

              SHA1

              44b8e2732fa1e2f204fc70eaa1cb406616250085

              SHA256

              8adf6748981c3e7b62f5dbca992be6675574fffbce7673743f2d7fe787d56a41

              SHA512

              b73083c2f7b028d2946cb8f7b4fe2289fedaa4175364a2aac37db0aeff4602aede772ccc9eba7e6dcfcb7276e52604ca45d8021952201b5834485b48bca3dc93

            • C:\Windows\Logo1_.exe

              Filesize

              27KB

              MD5

              2b90d375fad4e39663e1c00356e9206b

              SHA1

              5c84c40605f4af4185647e0a68aafed0ebbdc393

              SHA256

              623973fd332abcafc9944af01d2fe114d0293a00cc29a67300cde94769b337cf

              SHA512

              7c9491cf52bdea6936bb7b2e30562941ca26a41587e5fdd05e02d17e37b773ebf0856092b3030ae31da2ce43196682e96873c0c9adfc8525903b11bf36e4806f

            • F:\$RECYCLE.BIN\S-1-5-21-268080393-3149932598-1824759070-1000\_desktop.ini

              Filesize

              9B

              MD5

              7619ead719f9163af9f64f79eeff7c36

              SHA1

              7b956c82fba1f4a0ea8b09ca2e39d89159e21b75

              SHA256

              da9af76d7e3938d1bd300436de0d394ef0453f260a69c94905084222eb3fbb45

              SHA512

              29dd3ef54766931036c2f0d755bb3fc89619e548c95658577930a5a748ac2b2855a9e5ee5601697ebbac8a7d435abd4c9e9e2255b0e455e267e0d95358fa86df

            • memory/1208-29-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

              Filesize

              4KB

            • memory/2916-31-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/2916-38-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/2916-44-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/2916-90-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/2916-96-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/2916-477-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/2916-1873-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/2916-3333-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/2972-0-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/2972-17-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/2972-12-0x0000000000220000-0x0000000000255000-memory.dmp

              Filesize

              212KB