Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30/05/2024, 03:29

General

  • Target

    33ca50c4f96973afec1dac7bc22211b554b7a4a458e7272ad3d5b2fc7e6a229e.exe

  • Size

    959KB

  • MD5

    ecb2a6231699f4fe3c9da36d001494b5

  • SHA1

    a4293e7d2783e194b745e164451d0355be3a9ae9

  • SHA256

    33ca50c4f96973afec1dac7bc22211b554b7a4a458e7272ad3d5b2fc7e6a229e

  • SHA512

    e6fe76b1c270830ac47f1b67e4ef8d42d600083173c0bcb9ba70449e08754cf3b7379fad4ba172b4d88bdfef31b6a305f1f287c738ac5a1b7025ee1a4a198602

  • SSDEEP

    12288:QRKcv8Nh7py6Rmi78gkPH3aPI9vyVg/0paQuj3IdD02fKBjtp/:lBpDRmi78gkPXlyo0G/jr

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1192
      • C:\Users\Admin\AppData\Local\Temp\33ca50c4f96973afec1dac7bc22211b554b7a4a458e7272ad3d5b2fc7e6a229e.exe
        "C:\Users\Admin\AppData\Local\Temp\33ca50c4f96973afec1dac7bc22211b554b7a4a458e7272ad3d5b2fc7e6a229e.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2172
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$a786B.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1448
          • C:\Users\Admin\AppData\Local\Temp\33ca50c4f96973afec1dac7bc22211b554b7a4a458e7272ad3d5b2fc7e6a229e.exe
            "C:\Users\Admin\AppData\Local\Temp\33ca50c4f96973afec1dac7bc22211b554b7a4a458e7272ad3d5b2fc7e6a229e.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:2596
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1388
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2980
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2620

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        254KB

        MD5

        6594c9dee8b3a34129af16b59eab751a

        SHA1

        1edcd1a1f91ea569dedc1391610e2438b25dc3a1

        SHA256

        cb2c2d9ba31f305f280301882b6e859d27fc2210e2ab2a21232afb8a38d07571

        SHA512

        d53d9ec26500f4d4f2c19c036c57ef97d97b09f634a5772c7e31d088b22db508544beea563d50b51c336aef4ec737a9a39cf56f9df68676ff6e97900362541d3

      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

        Filesize

        474KB

        MD5

        6f0ec1ca208b0521f58bcd694897df06

        SHA1

        808a16d524301513af8ee772936f6bdcf41623a6

        SHA256

        53b5d4205b0f2ae4ba0051244fffcaf0cfecbf78dfc448e4d2e68e53e15f15bf

        SHA512

        d8318484059a9988dae4b8a53d1ccec1a54ed825e1937d70fccc9bd26222a0c4b23718f368e6d193e6dd7b9d999e5e8d5f23717ea160468b6287004a722503f2

      • C:\Users\Admin\AppData\Local\Temp\$$a786B.bat

        Filesize

        722B

        MD5

        e73bb8b1828c4df03339422830161389

        SHA1

        76712bc03ae4217c4b9bec4f8fb14913acb76fda

        SHA256

        25bb746d78496c36d6abe410990a8fec166b40b2b708986b873ca696a9b37a89

        SHA512

        67b61bb88a6e28678ee3b17f4ce60e8496c5bcd90a2713c1a4eb059707f0f02bfdde52f14979e5576dc47eb1b284784e919eb7ae7688ecaedc8c036d244ce64c

      • C:\Users\Admin\AppData\Local\Temp\33ca50c4f96973afec1dac7bc22211b554b7a4a458e7272ad3d5b2fc7e6a229e.exe.exe

        Filesize

        930KB

        MD5

        30ac0b832d75598fb3ec37b6f2a8c86a

        SHA1

        6f47dbfd6ff36df7ba581a4cef024da527dc3046

        SHA256

        1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

        SHA512

        505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

      • C:\Windows\Logo1_.exe

        Filesize

        29KB

        MD5

        e138d7d47ace7dfa816f7ac64e8d4898

        SHA1

        9d0be22461b768c1f2541e204d6b0de4e6de18d6

        SHA256

        2cfdf912ecaf532855d684e10474a60243b5ed381d522669ee6c3c4ba0fffe75

        SHA512

        bbbcd2879ebe1e566ae56f98c45a76aad8f58201b791156328661b98a1adaa89b98e0e1888c1eac3052f298afad2b09da1817c1b8911fa2da77bc87e5927b568

      • F:\$RECYCLE.BIN\S-1-5-21-330940541-141609230-1670313778-1000\_desktop.ini

        Filesize

        9B

        MD5

        588b2065b2adfd8dfd688104d02aad5a

        SHA1

        263f0ca294d728a13f51220aea8123aa257cc6e2

        SHA256

        f9ab49edf14c6bda17287f7caa63d3b3bb20a65215f1462cf05577a5c1c472e6

        SHA512

        99106035ac4547c81fd737f5f79ddd32ea10fde9e3ea97102472c871aa9f94ee3f68823bcc4bb308e92265a9c3cacd4b1f5c9f52f8d3e630cdf6bdcd3c737e2d

      • memory/1192-31-0x0000000002220000-0x0000000002221000-memory.dmp

        Filesize

        4KB

      • memory/1388-19-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1388-34-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1388-41-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1388-48-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1388-94-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1388-100-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1388-264-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1388-1853-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1388-3313-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2172-18-0x0000000000220000-0x0000000000256000-memory.dmp

        Filesize

        216KB

      • memory/2172-0-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2172-17-0x0000000000220000-0x0000000000256000-memory.dmp

        Filesize

        216KB

      • memory/2172-15-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB