Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 01:10

General

  • Target

    99b1768180e2fb86c530c5e318db1cfee08be67f3d56f1dbb65d844341c1dc17.exe

  • Size

    846KB

  • MD5

    32a9877928fa90596a32d4a11450ff63

  • SHA1

    b37f7cdeae88f8a76c625ce5ff00556cee8c74cb

  • SHA256

    99b1768180e2fb86c530c5e318db1cfee08be67f3d56f1dbb65d844341c1dc17

  • SHA512

    1a9683e86de0729e65e6644bde440e4ebd1b6815df4bbafef0d860eaceb378087ae6ba64a3806b19f0961413760a47a4f21ceb6ba298ea52fcec50ea06a0a944

  • SSDEEP

    6144:9uj8NDF3OR9/Qe2HdJ8pS2ts8UxILaOTq:UOF3ORK3d12ts8U6LaOTq

Score
9/10

Malware Config

Signatures

  • Detects executables packed with ASPack 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99b1768180e2fb86c530c5e318db1cfee08be67f3d56f1dbb65d844341c1dc17.exe
    "C:\Users\Admin\AppData\Local\Temp\99b1768180e2fb86c530c5e318db1cfee08be67f3d56f1dbb65d844341c1dc17.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
      "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2076
      • C:\Windows\SysWOW64\casino_extensions.exe
        C:\Windows\system32\casino_extensions.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1708
        • C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
          "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
          4⤵
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          PID:2620
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c $$2028~1.BAT
            5⤵
              PID:2536
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 236
          3⤵
          • Program crash
          PID:2648

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Internet Explorer\$$202803s.bat

            Filesize

            81B

            MD5

            4777bf695815d870d27ed4a38a8f0840

            SHA1

            565412b5182bca7a221448dba78369c42d1c4a0c

            SHA256

            c08018226d9a45ab277a01ca35f519ff7ea1cb450d080e24b0f590739654241d

            SHA512

            87e792d326c5a9d2d92984ec4c34d2af9d616a4676a7d69df73b09975fd077d96077ae2528b6fc05752110eb4e406c3e9d94d49d0a74eeaba6bc6a48bca8ac1d

          • C:\Windows\SysWOW64\LiveMessageCenter.exe

            Filesize

            854KB

            MD5

            b5f50169d28bad7fcf9933e501073a3a

            SHA1

            694839ad32c783cae3b9c3bb348f2119e51b7af2

            SHA256

            723e8dd5cff6f58f118a4ccd240289ce51baf6df9e09bf76182a776694bef106

            SHA512

            a1719068603a7fa57149c48257eaf2a16659c44e4b9e2b6be349d006189af1e74a400145a95cf94834f0d761024fdc1c64e9d80ed0ec53392fc1f5a6a3a45231

          • \Windows\SysWOW64\casino_extensions.exe

            Filesize

            850KB

            MD5

            04ca26dd1d4c47f762472821939ce72b

            SHA1

            6f2a9d11a61b584001f83b584287928c10fc133f

            SHA256

            5a40580bbb3a3812523c0bd08dc5035deca878992b8b1b7e585f897a9ba9d15a

            SHA512

            d237225187ea608fa7c8d14222512fd2c7b190fcea89882bc5bb1476b041feb885c0d1fb437803ad8b88d2363591c322bb2be2ab6dee2d3c947bf2ff22a1e5ee

          • memory/2756-23-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/2756-26-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB