Analysis

  • max time kernel
    150s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 00:36

General

  • Target

    61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe

  • Size

    68KB

  • MD5

    23f8010c15a4e25ee61c616bfd27b700

  • SHA1

    dfee92c5b7bc4e3fafd36de439a88564a4df47a1

  • SHA256

    61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4

  • SHA512

    4507de6945e05ad1cc989f0917975ddb9d58a5d5c49469eb0a6e095caae8a8fca19bb8390b81f4a44395885f7e4831cf1c39f7519786e785886b84e9a3dbc8f5

  • SSDEEP

    1536:Kz3SHmLKarIpYeEToa9D4ZQKbgZi1dst7x9PxQ:akF3pdlZQKbgZi1St7xQ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3532
      • C:\Users\Admin\AppData\Local\Temp\61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe
        "C:\Users\Admin\AppData\Local\Temp\61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4180
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42D5.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4264
          • C:\Users\Admin\AppData\Local\Temp\61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe
            "C:\Users\Admin\AppData\Local\Temp\61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe"
            4⤵
            • Executes dropped EXE
            PID:2596
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4356
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2348
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:3084

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

              Filesize

              252KB

              MD5

              6735a16d04dfac1f92f7ab89c64b071f

              SHA1

              502eaa755229fc80b186faf533cf827c322bab66

              SHA256

              3a071105a38c10f7fa17dcc239337e999b57b68f4bd05c168b2548956931383c

              SHA512

              bfe01bb853f187f68d0fe64da2da4cf1d26c0491eb3183a7c7d5e905a1b1c3db90b84c1cdadb00c7d7f733ef32a9153dfa73de5259d9f1c3d401633145b420a8

            • C:\Program Files\7-Zip\7z.exe

              Filesize

              571KB

              MD5

              bab747a805ee67f925718f2624d54a11

              SHA1

              3f6fa0fe958f3a43e38c66014443e0c261f46bcc

              SHA256

              03078980fff7ce8873b7e46fd8b79c2a86bb0354fc65268eac2aeff6d981e73e

              SHA512

              65edbfebdfdf27c496f596bac45f63cd4834dbfb171bd2683a15a3d207b489ee65a045a0b78729005b457f551f128f444fba45baa63c8fe8748f422f48431c14

            • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

              Filesize

              637KB

              MD5

              9cba1e86016b20490fff38fb45ff4963

              SHA1

              378720d36869d50d06e9ffeef87488fbc2a8c8f7

              SHA256

              a22e6d0f5c7d44fefc2204e0f7c7b048e1684f6cf249ba98c006bbf791c22d19

              SHA512

              2f3737d29ea3925d10ea5c717786425f6434be732974586328f03691a35cd1539828e3301685749e5c4135b8094f15b87fb9659915de63678a25749e2f8f5765

            • C:\Users\Admin\AppData\Local\Temp\$$a42D5.bat

              Filesize

              722B

              MD5

              3c432e8c401243174cc6291a7ba7af5e

              SHA1

              6da9f37e17bf9164c807fd9757831c8b84f85b63

              SHA256

              58bdbfc1ab73431e7a0c353523eb7dc77e918217e47c26ea71ca165f4cbd3c41

              SHA512

              0463445ccbb0335864a58f98d09fad2a5cd34def9a04c1cb7eccef900fbbddac44559daac64174ff9b84fcb96312467c09a04713b9df8466ee23ec5ccf52b381

            • C:\Users\Admin\AppData\Local\Temp\61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe.exe

              Filesize

              41KB

              MD5

              977e405c109268909fd24a94cc23d4f0

              SHA1

              af5d032c2b6caa2164cf298e95b09060665c4188

              SHA256

              cd24c61fe7dc3896c6c928c92a2adc58fab0a3ff61ef7ddcac1ba794182ab12f

              SHA512

              12b4b59c1a8e65e72aa07ee4b6b6cd9fdedead01d5ce8e30f16ca26b5d733655e23a71c1d273a950a5b1a6cce810b696612de4a1148ac5f468ddf05d4549eed5

            • C:\Windows\rundl132.exe

              Filesize

              27KB

              MD5

              2b90d375fad4e39663e1c00356e9206b

              SHA1

              5c84c40605f4af4185647e0a68aafed0ebbdc393

              SHA256

              623973fd332abcafc9944af01d2fe114d0293a00cc29a67300cde94769b337cf

              SHA512

              7c9491cf52bdea6936bb7b2e30562941ca26a41587e5fdd05e02d17e37b773ebf0856092b3030ae31da2ce43196682e96873c0c9adfc8525903b11bf36e4806f

            • F:\$RECYCLE.BIN\S-1-5-21-1337824034-2731376981-3755436523-1000\_desktop.ini

              Filesize

              9B

              MD5

              7619ead719f9163af9f64f79eeff7c36

              SHA1

              7b956c82fba1f4a0ea8b09ca2e39d89159e21b75

              SHA256

              da9af76d7e3938d1bd300436de0d394ef0453f260a69c94905084222eb3fbb45

              SHA512

              29dd3ef54766931036c2f0d755bb3fc89619e548c95658577930a5a748ac2b2855a9e5ee5601697ebbac8a7d435abd4c9e9e2255b0e455e267e0d95358fa86df

            • memory/4180-9-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/4180-0-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/4356-26-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/4356-36-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/4356-32-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/4356-1230-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/4356-19-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/4356-4796-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/4356-10-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/4356-5235-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB