Analysis

  • max time kernel
    152s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 00:35

General

  • Target

    dcae0255b8a638f19b0faf5d417ff7ae2c2a0b3b4131341242d3c10468b950e2.exe

  • Size

    225KB

  • MD5

    1be2b5d30a6472fb7df8961f7d7fbb66

  • SHA1

    00ef859167ae69a8047c0bd326db606143692258

  • SHA256

    dcae0255b8a638f19b0faf5d417ff7ae2c2a0b3b4131341242d3c10468b950e2

  • SHA512

    a4b066be350cad053b4a2f6490c46cc6d079696d2db3be58196894a9cf91468f7822724eb67ce283283e6b89e2d9498f67e276900213b5d95ee6e4d6cab67f94

  • SSDEEP

    3072:akF3pkdeKzC/lzMPySe8DnpeIPipoHbKvXWXz9LRnsaJUS+6wPXD3fxNW7gq5yGP:PFpkdeKzC/leySe8AIqpoHbnDns1ND9m

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3268
      • C:\Users\Admin\AppData\Local\Temp\dcae0255b8a638f19b0faf5d417ff7ae2c2a0b3b4131341242d3c10468b950e2.exe
        "C:\Users\Admin\AppData\Local\Temp\dcae0255b8a638f19b0faf5d417ff7ae2c2a0b3b4131341242d3c10468b950e2.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:628
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4C0.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1304
          • C:\Users\Admin\AppData\Local\Temp\dcae0255b8a638f19b0faf5d417ff7ae2c2a0b3b4131341242d3c10468b950e2.exe
            "C:\Users\Admin\AppData\Local\Temp\dcae0255b8a638f19b0faf5d417ff7ae2c2a0b3b4131341242d3c10468b950e2.exe"
            4⤵
            • Executes dropped EXE
            PID:3132
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2992
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4864
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:4740
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:4956

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

                Filesize

                252KB

                MD5

                6735a16d04dfac1f92f7ab89c64b071f

                SHA1

                502eaa755229fc80b186faf533cf827c322bab66

                SHA256

                3a071105a38c10f7fa17dcc239337e999b57b68f4bd05c168b2548956931383c

                SHA512

                bfe01bb853f187f68d0fe64da2da4cf1d26c0491eb3183a7c7d5e905a1b1c3db90b84c1cdadb00c7d7f733ef32a9153dfa73de5259d9f1c3d401633145b420a8

              • C:\Program Files\7-Zip\7z.exe

                Filesize

                571KB

                MD5

                bab747a805ee67f925718f2624d54a11

                SHA1

                3f6fa0fe958f3a43e38c66014443e0c261f46bcc

                SHA256

                03078980fff7ce8873b7e46fd8b79c2a86bb0354fc65268eac2aeff6d981e73e

                SHA512

                65edbfebdfdf27c496f596bac45f63cd4834dbfb171bd2683a15a3d207b489ee65a045a0b78729005b457f551f128f444fba45baa63c8fe8748f422f48431c14

              • C:\Users\Admin\AppData\Local\Temp\$$aF4C0.bat

                Filesize

                722B

                MD5

                5b48b9faad06525d9632a4e49dbb8ca7

                SHA1

                750b8c73cc0dadc888c85ba345721767347e881d

                SHA256

                f86a69b534206aade43edd225dbfd6d5e78cc015ee300a95f3d71bc6584ac301

                SHA512

                544a422601c1bad4b5e3ad1a275eb16b06d9b26dfeebf167b207e1631bbe41714201f80251feebafb1ba9ea98ae643ee5dde26958be9ff90bac4e2d064828607

              • C:\Users\Admin\AppData\Local\Temp\dcae0255b8a638f19b0faf5d417ff7ae2c2a0b3b4131341242d3c10468b950e2.exe.exe

                Filesize

                198KB

                MD5

                e133c2d85cff4edd7fe8e8f0f8be6cdb

                SHA1

                b8269209ebb6fe44bc50dab35f97b0ae244701b4

                SHA256

                6c5e7d9c81a409e67c143cd3aed33bddc3967fa4c9ab3b98560b7d3bf57d093d

                SHA512

                701b7d1c7e154519d77043f7de09d60c1ff76c95f820fc1c9afca19724efb0847d646686053354156fd4e8a9dab1f29a79d3223f939a3ff1b3613770dc8603b1

              • C:\Windows\Logo1_.exe

                Filesize

                27KB

                MD5

                2b90d375fad4e39663e1c00356e9206b

                SHA1

                5c84c40605f4af4185647e0a68aafed0ebbdc393

                SHA256

                623973fd332abcafc9944af01d2fe114d0293a00cc29a67300cde94769b337cf

                SHA512

                7c9491cf52bdea6936bb7b2e30562941ca26a41587e5fdd05e02d17e37b773ebf0856092b3030ae31da2ce43196682e96873c0c9adfc8525903b11bf36e4806f

              • F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\_desktop.ini

                Filesize

                9B

                MD5

                7619ead719f9163af9f64f79eeff7c36

                SHA1

                7b956c82fba1f4a0ea8b09ca2e39d89159e21b75

                SHA256

                da9af76d7e3938d1bd300436de0d394ef0453f260a69c94905084222eb3fbb45

                SHA512

                29dd3ef54766931036c2f0d755bb3fc89619e548c95658577930a5a748ac2b2855a9e5ee5601697ebbac8a7d435abd4c9e9e2255b0e455e267e0d95358fa86df

              • memory/628-11-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/628-0-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2992-34-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2992-27-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2992-38-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2992-42-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2992-9-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2992-242-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2992-1016-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2992-1183-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2992-2144-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2992-20-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB