Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 07:34

General

  • Target

    deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe

  • Size

    1.6MB

  • MD5

    15fdfb61c3bcf26af3548d7fade4a8ae

  • SHA1

    d76af19cc583ea66d0caa943a9593761c19dd020

  • SHA256

    deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8

  • SHA512

    ef7c675344345e9a9d354c583d29b589571a2b892fe03f2d620f04fe955a82d838a611aef44fed844ad66be916c95b784b754f3eeec693a7ffaaa02e8095d956

  • SSDEEP

    24576:77Fy4FMmZg15PgU+/uka4YjCp/SKhdm87PUY9Zbvhjdqdb3rWBvO0yjm0cg78:7737Rp/7dmGN9tJjdqRrwvol78

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3428
      • C:\Users\Admin\AppData\Local\Temp\deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
        "C:\Users\Admin\AppData\Local\Temp\deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2876
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4006.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4776
          • C:\Users\Admin\AppData\Local\Temp\deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
            "C:\Users\Admin\AppData\Local\Temp\deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe"
            4⤵
            • Executes dropped EXE
            • Writes to the Master Boot Record (MBR)
            PID:616
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1344
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1096
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:740

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

              Filesize

              251KB

              MD5

              3d1572bb8bd0f47c8bae09ad1cd6d327

              SHA1

              1200b1b3f2404dcef74dfcf8affde5b605bc9114

              SHA256

              60aa8a96919888258a3b10447d91f4f83993e7fefbf9c7e32b21124c1cdfd262

              SHA512

              d7b7b18682e5f58e72b9d3a27c2d334c3db00e44a6b1faf1a765390356e8b20e69e4189e95487e56c3aca2710d761fecc069d764e73b64ea4ae6229f3460f9b0

            • C:\Program Files\7-Zip\7z.exe

              Filesize

              570KB

              MD5

              de9e360e0645c5ca6fcadc535349fd0a

              SHA1

              5c6708b6fbcb5b77b151caa0f019bfd6059daf39

              SHA256

              44e4bb89ae548437dc66df1372b524c43c847e040cbdc3f29a74b6e503808aac

              SHA512

              58a32506954131637da992fac681a673273ebb006cbc6a2f902c5363a04c5e37c05ef46051646a14dbce42b0ba00b98cd2a9c6a8c25109b721aab15b785a84ba

            • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

              Filesize

              636KB

              MD5

              2500f702e2b9632127c14e4eaae5d424

              SHA1

              8726fef12958265214eeb58001c995629834b13a

              SHA256

              82e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c

              SHA512

              f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c

            • C:\Users\Admin\AppData\Local\Temp\$$a4006.bat

              Filesize

              722B

              MD5

              a8e7458616ad1354b354cbe060c16b3d

              SHA1

              beebee3e2567434b65a197271f9e6c19a2016f34

              SHA256

              efb506ceaa1e56e44322c07b307ffa016170226ab308b8aba9101a10c0352a15

              SHA512

              22dd5af0e35b37a96411d805c04ebad143e8f79048977b61fb9637dd424f0c9ea5085a922297c745e55db651635805d3a711aeda3beed705ece27e1d3ef1e519

            • C:\Users\Admin\AppData\Local\Temp\deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe.exe

              Filesize

              1.6MB

              MD5

              fd3162b9c1bd31c14851d3baf1055a90

              SHA1

              efe65a5df571257e15186ea339769cb61a98e2c3

              SHA256

              7fae64292d2c11b04a990140ab7b12f5a37eb74998c16a174ec13339783893b8

              SHA512

              d64efd63595fff017e3e90d1eb1203c28a4131444a71d7111efb2ec7761578f498da31409f5aa57a47c118c6727fab18371e4687d651b26847e543c478b83636

            • C:\Windows\Logo1_.exe

              Filesize

              26KB

              MD5

              0a9fcb5422705ccc52b97a0f291ad9bc

              SHA1

              1464f8724a42524e5dc47483eb6288e9c34fec22

              SHA256

              85272876bcd6492a6bb54bfc95d2c4dc6d8cbee27dc11f7a60cad6620954a933

              SHA512

              f719785fecf4087ebd2ca0ff8ade00136472ab2b41dedcf3a9ecbb902f669c7449b395d0c92a9c2e6514dc48447c9eafaa54baf667f0050c42d212a08e632c3b

            • F:\$RECYCLE.BIN\S-1-5-21-540404634-651139247-2967210625-1000\_desktop.ini

              Filesize

              9B

              MD5

              a470ca2426c102d035971b2e504d921b

              SHA1

              1720ef61e5c8e2ad6da9992a78940228fc81d615

              SHA256

              13721d3153b316d1b54c64b67de19ae5147cb78e332448e6b800f6d510c269f5

              SHA512

              c12907d26eac47d219aaa47b11d243738b0e698f898f9f2bd199652bc094197227ce12bc5fc96f5da25f1fd7b5904fe71ee3792105b05ac13a135d89aa1c1831

            • memory/1344-27-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/1344-33-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/1344-37-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/1344-20-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/1344-1231-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/1344-13-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/1344-4797-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/1344-5236-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/2876-0-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB

            • memory/2876-9-0x0000000000400000-0x0000000000434000-memory.dmp

              Filesize

              208KB