Analysis

  • max time kernel
    132s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 01:10

General

  • Target

    99b1768180e2fb86c530c5e318db1cfee08be67f3d56f1dbb65d844341c1dc17.exe

  • Size

    846KB

  • MD5

    32a9877928fa90596a32d4a11450ff63

  • SHA1

    b37f7cdeae88f8a76c625ce5ff00556cee8c74cb

  • SHA256

    99b1768180e2fb86c530c5e318db1cfee08be67f3d56f1dbb65d844341c1dc17

  • SHA512

    1a9683e86de0729e65e6644bde440e4ebd1b6815df4bbafef0d860eaceb378087ae6ba64a3806b19f0961413760a47a4f21ceb6ba298ea52fcec50ea06a0a944

  • SSDEEP

    6144:9uj8NDF3OR9/Qe2HdJ8pS2ts8UxILaOTq:UOF3ORK3d12ts8U6LaOTq

Score
9/10

Malware Config

Signatures

  • Detects executables packed with ASPack 5 IoCs
  • Executes dropped EXE 7 IoCs
  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99b1768180e2fb86c530c5e318db1cfee08be67f3d56f1dbb65d844341c1dc17.exe
    "C:\Users\Admin\AppData\Local\Temp\99b1768180e2fb86c530c5e318db1cfee08be67f3d56f1dbb65d844341c1dc17.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
      "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Windows\SysWOW64\casino_extensions.exe
        C:\Windows\system32\casino_extensions.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1312
        • C:\Windows\SysWOW64\Casino_ext.exe
          C:\Windows\SysWOW64\Casino_ext.exe
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2320
          • C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
            "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
            5⤵
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:1516
            • C:\Windows\SysWOW64\casino_extensions.exe
              C:\Windows\system32\casino_extensions.exe
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of WriteProcessMemory
              PID:4936
              • C:\Windows\SysWOW64\Casino_ext.exe
                C:\Windows\SysWOW64\Casino_ext.exe
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4968
                • C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
                  "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
                  8⤵
                  • Drops file in System32 directory
                  • Suspicious use of WriteProcessMemory
                  PID:4784
                  • C:\Windows\SysWOW64\LiveMessageCenter.exe
                    C:\Windows\system32\LiveMessageCenter.exe /part2
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:1964
                    • C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
                      "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
                      10⤵
                      • Drops file in System32 directory
                      • Suspicious use of WriteProcessMemory
                      PID:2860
                      • C:\Windows\SysWOW64\casino_extensions.exe
                        C:\Windows\system32\casino_extensions.exe
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Suspicious use of WriteProcessMemory
                        PID:2420
                        • C:\Windows\SysWOW64\Casino_ext.exe
                          C:\Windows\SysWOW64\Casino_ext.exe
                          12⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:5056
                          • C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
                            "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
                            13⤵
                            • Drops file in System32 directory
                            • Drops file in Program Files directory
                            • Suspicious use of WriteProcessMemory
                            PID:1392
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c $$2028~1.BAT
                              14⤵
                                PID:3700

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Internet Explorer\$$202803s.bat

            Filesize

            81B

            MD5

            4777bf695815d870d27ed4a38a8f0840

            SHA1

            565412b5182bca7a221448dba78369c42d1c4a0c

            SHA256

            c08018226d9a45ab277a01ca35f519ff7ea1cb450d080e24b0f590739654241d

            SHA512

            87e792d326c5a9d2d92984ec4c34d2af9d616a4676a7d69df73b09975fd077d96077ae2528b6fc05752110eb4e406c3e9d94d49d0a74eeaba6bc6a48bca8ac1d

          • C:\Windows\SysWOW64\LiveMessageCenter.exe

            Filesize

            861KB

            MD5

            0aef1c727cb8ab33963b1a3e2575723a

            SHA1

            31d82d43781322b9454e6c8cc9d264bb77b3101c

            SHA256

            bdbe5bc6d6b59bb3f97e2840f6e6d198e907335f2992461dad49b9db34c6d588

            SHA512

            e1d5c72b4e4df724d5ecdff75dd590022f607c181fd02974fc157715bfa275b80988fbf50ae6d567814b68a2340ad0330db6cab10fdeda6d1fc9c61b3cad743f

          • C:\Windows\SysWOW64\casino_extensions.exe

            Filesize

            858KB

            MD5

            0eeb1c5835c01712d6b08260aec5d3df

            SHA1

            19d98b74138bc55671a438eb6c6d817ebd150342

            SHA256

            49ac766c057f4e19fc404bdd56ffadf7e230463e5a61f9e4c5a435692534436c

            SHA512

            1782166620f1d584c0bda10470794e4411fb7cfdf47e8e0b2b169046e5d835389629ee8c1f433d19964c2993428ed2dfd726418e2606195daf621f68685cc5c2

          • C:\Windows\SysWOW64\casino_extensions.exe

            Filesize

            848KB

            MD5

            9ac2e818814ab94f01c4930469bf7132

            SHA1

            9e53a54502809d1b1b5082e10c6318d76d3262a1

            SHA256

            5a298b06e0f2f85f770c4a96a6c69a7e0d200eb555455440e2db7a6526381694

            SHA512

            2094741ba1c3e6c29003869815d8b47fee3a7b61cb1576b1b532d0605e2a9471f3996252f1d56a17333190d90f535db57795191a8766f961ec712ee90842c6cd

          • memory/1312-8-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/2876-7-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB