Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 01:11

General

  • Target

    99c75afcbdd73e4122db993d12627296841c22757c4b72839d0cb1a9dd94fc97.exe

  • Size

    765KB

  • MD5

    1efff2a5cbd5af55693374077fcd51fb

  • SHA1

    b845dfadbc01e85111af97db05de84c50f2463fc

  • SHA256

    99c75afcbdd73e4122db993d12627296841c22757c4b72839d0cb1a9dd94fc97

  • SHA512

    a70c427da1d7a9d09bf5e714670b29281801060017bb9a9d26279c6a4ae1e3ed657a80427eef71bbd00744f28ac08898a865172a51cda72bcc295d5f41b66330

  • SSDEEP

    3072:ltwizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdOylqwMqle7xa2i1hrxFpKUWZ2Q:vuj8NDF3OR9/Qe2HdJ8RAbrycW

Score
9/10

Malware Config

Signatures

  • Detects executables packed with ASPack 5 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 12 IoCs
  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99c75afcbdd73e4122db993d12627296841c22757c4b72839d0cb1a9dd94fc97.exe
    "C:\Users\Admin\AppData\Local\Temp\99c75afcbdd73e4122db993d12627296841c22757c4b72839d0cb1a9dd94fc97.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2892
    • C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
      "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1688
      • C:\Windows\SysWOW64\casino_extensions.exe
        C:\Windows\system32\casino_extensions.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2900
        • C:\Windows\SysWOW64\Casino_ext.exe
          C:\Windows\SysWOW64\Casino_ext.exe
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3024
          • C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
            "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
            5⤵
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:2492
            • C:\Windows\SysWOW64\casino_extensions.exe
              C:\Windows\system32\casino_extensions.exe
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of WriteProcessMemory
              PID:2668
              • C:\Windows\SysWOW64\Casino_ext.exe
                C:\Windows\SysWOW64\Casino_ext.exe
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2796
                • C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
                  "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
                  8⤵
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • Suspicious use of WriteProcessMemory
                  PID:2292
                  • C:\Windows\SysWOW64\casino_extensions.exe
                    C:\Windows\system32\casino_extensions.exe
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of WriteProcessMemory
                    PID:2672
                    • C:\Windows\SysWOW64\Casino_ext.exe
                      C:\Windows\SysWOW64\Casino_ext.exe
                      10⤵
                      • Executes dropped EXE
                      • Drops file in Program Files directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:2144
                      • C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
                        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
                        11⤵
                        • Loads dropped DLL
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:2604
                        • C:\Windows\SysWOW64\LiveMessageCenter.exe
                          C:\Windows\system32\LiveMessageCenter.exe /part2
                          12⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:2716
                          • C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
                            "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
                            13⤵
                            • Loads dropped DLL
                            • Drops file in System32 directory
                            • Suspicious use of WriteProcessMemory
                            PID:2628
                            • C:\Windows\SysWOW64\casino_extensions.exe
                              C:\Windows\system32\casino_extensions.exe
                              14⤵
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of WriteProcessMemory
                              PID:2532
                              • C:\Windows\SysWOW64\Casino_ext.exe
                                C:\Windows\SysWOW64\Casino_ext.exe
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2660
                                • C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
                                  "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
                                  16⤵
                                  • Loads dropped DLL
                                  • Drops file in System32 directory
                                  • Suspicious use of WriteProcessMemory
                                  PID:2360
                                  • C:\Windows\SysWOW64\LiveMessageCenter.exe
                                    C:\Windows\system32\LiveMessageCenter.exe
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2384
                                    • C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
                                      "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
                                      18⤵
                                      • Drops file in System32 directory
                                      • Drops file in Program Files directory
                                      PID:2440
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c $$2028~1.BAT
                                        19⤵
                                        • Deletes itself
                                        PID:1592

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Internet Explorer\$$202803s.bat

          Filesize

          81B

          MD5

          4777bf695815d870d27ed4a38a8f0840

          SHA1

          565412b5182bca7a221448dba78369c42d1c4a0c

          SHA256

          c08018226d9a45ab277a01ca35f519ff7ea1cb450d080e24b0f590739654241d

          SHA512

          87e792d326c5a9d2d92984ec4c34d2af9d616a4676a7d69df73b09975fd077d96077ae2528b6fc05752110eb4e406c3e9d94d49d0a74eeaba6bc6a48bca8ac1d

        • \Windows\SysWOW64\LiveMessageCenter.exe

          Filesize

          768KB

          MD5

          4f8d1b18208210b4376b5907120d2ca3

          SHA1

          6dc886b17f0ae2499e317857dfcd70184d85f6da

          SHA256

          3ee4d7ca464069120e125febe12e3b55eb6f8785ab5912f1b9b34305eedec183

          SHA512

          edc87c629966072675f3d35455c14834a52406b8a1b3657ed3b9ffc478ae1c9459765161a4a84380a1e281368151b6f9e720f3676c94e1fb5af6b7106135f1ed

        • \Windows\SysWOW64\casino_extensions.exe

          Filesize

          772KB

          MD5

          355a0fda6d3b0d4f2ff5a6130137fda5

          SHA1

          be99e7b951e899923eca9057e96f7a6cdad7ad9a

          SHA256

          f1b7fd371ddf4e1931f7cd96efc976dbe20649f1767fe5f0d83dacddac901a52

          SHA512

          98f905cf419e90f6059170fd199b45e9816bb6e289867579ee31df3b13a57c222ffece476c536e7ae4f697dbe5260562e7da5c50f0f6b53f158ec6dc1386ce31

        • \Windows\SysWOW64\casino_extensions.exe

          Filesize

          772KB

          MD5

          d4bbeb11bcbadc0d8a6f12bc5cf4ccec

          SHA1

          cf0aca091ba6c17c9268c518d80a719a2738c109

          SHA256

          d3774a8145d3083d24b9fd2cacfb6c1961deadad2b6b81c87762ce7cb722ae11

          SHA512

          2a25f4d8474841638783837c45105fcf3eb9aa69889058048db4a479e6e9772b5a05d97505e9a7317f092206ba99e2aecef7d881a9df8e4bd2111e852f7b2e4d

        • memory/2892-13-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

        • memory/2900-12-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB