Analysis

  • max time kernel
    152s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 10:43

General

  • Target

    b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe

  • Size

    100KB

  • MD5

    50458e0e3de0cd602647b63607892642

  • SHA1

    c5f443fd65e717ecee1af1f2148be813283c299d

  • SHA256

    b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693

  • SHA512

    8a3055fcaa672def4b1efd38b9bedff8f3ef639a3fc6c113a4d793cfa5169ddcd4d6c1c8b9cec5160ea5eb5f0d18e861c8915cef801075074a9632989c7fd371

  • SSDEEP

    768:Uf1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoLHxurmSoqCzX3zIp8J80CpxuUe0Cp:UNfgLdQAQfcfymNnLzkTEuL7lfT9S

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3300
      • C:\Users\Admin\AppData\Local\Temp\b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe
        "C:\Users\Admin\AppData\Local\Temp\b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4768
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD59.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:768
          • C:\Users\Admin\AppData\Local\Temp\b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe
            "C:\Users\Admin\AppData\Local\Temp\b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe"
            4⤵
            • Executes dropped EXE
            PID:3668
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4488
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:5076
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:4956
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:4552

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

                Filesize

                251KB

                MD5

                10e927db6aae50e89fcb4d441d9e27e1

                SHA1

                6a2250c03aba8fe7a9c388742db5ac4e473fa178

                SHA256

                a68e60f5bc35fdb50525110f44ad636498278629d38a3854369e9a93ed70ee19

                SHA512

                1d6c8b2d48403d037fc31ffeee690ca956ed8595671e1400c8dad69347ac0749d94498b00feec325575d98d300c0694d0083ca7e2e72a124ff45e9f74dd09227

              • C:\Program Files\7-Zip\7z.exe

                Filesize

                570KB

                MD5

                b322a272bfc6d40615d88a259b3f0216

                SHA1

                de89b902e2c003fd4baec5770db6427e3c6b3d17

                SHA256

                4842c0008eddf4d4dabd0266c3ddbb5f34177104eb7b2341baea6fb4b02a2b76

                SHA512

                4691ef362831d06f431d096e0e21f5b06c8d311a748e7e25bde9e9b2481afe0a8ddea7923e5cf0191c601543c10ca714ba442c9ec2222f9e890cff7f33c3521c

              • C:\Users\Admin\AppData\Local\Temp\$$aD59.bat

                Filesize

                721B

                MD5

                5e5e224ea5701d9bc87fbb9ed05ed56f

                SHA1

                45a7da24048e884c32082b948721046499f4c7e1

                SHA256

                20a8c2c4361f5096200198049a2d99bc7179de262903c19be3cef51ee4dd8fca

                SHA512

                2b9628d3b4d0aa2eded3cf2e9f1bd33f519fe957f5539fe77998a35bec41055d75531e36ba76a53a267f74370e6d7e9844977dced913d527c05e8920591aaea8

              • C:\Users\Admin\AppData\Local\Temp\b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe.exe

                Filesize

                74KB

                MD5

                545d1e26963a478eee9bb844caac1802

                SHA1

                cfb64537a634a1f7111ab799c05a706a0869b55a

                SHA256

                b88ea7dadb71946c6b5d9b6a2c6c974cd5b6a29408eb63bde7953713057f3f7d

                SHA512

                45ce1c2a4be515e19633a704a8b92cc0756bf268e942b5d9e60ae1e0492bf82486af1c91162e1595b5a6742134a52e98012ab25d97216615b997121e30d20a74

              • C:\Windows\Logo1_.exe

                Filesize

                26KB

                MD5

                e7093a12cfd837f03fc2aa86eaa886ba

                SHA1

                bfeb2bd83d5d07adb9e0df6d23177660982f884d

                SHA256

                9ce4f790a3ad9cb93ba0b875d0888db7e560fbbbceb022a1624252a26dde4db2

                SHA512

                8ff9f31ff0e19431aec46a5ba04387ea145f42d4480911f5ea07deb9e8e48b6ce631d919746fa7446568a3a5e56c23a92f1e632379580cd286e7bdcc04350f55

              • F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\_desktop.ini

                Filesize

                9B

                MD5

                a470ca2426c102d035971b2e504d921b

                SHA1

                1720ef61e5c8e2ad6da9992a78940228fc81d615

                SHA256

                13721d3153b316d1b54c64b67de19ae5147cb78e332448e6b800f6d510c269f5

                SHA512

                c12907d26eac47d219aaa47b11d243738b0e698f898f9f2bd199652bc094197227ce12bc5fc96f5da25f1fd7b5904fe71ee3792105b05ac13a135d89aa1c1831

              • memory/4488-32-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/4488-19-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/4488-26-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/4488-37-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/4488-41-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/4488-8-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/4488-86-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/4488-1181-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/4488-1300-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/4488-4397-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/4768-12-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/4768-0-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB