Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01-06-2024 05:41

General

  • Target

    fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe

  • Size

    89KB

  • MD5

    4dd695aa2695ec57cd9998536790b010

  • SHA1

    03a04922b652da53fa3fbdfd4588922b1896b2d4

  • SHA256

    fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c

  • SHA512

    1ac4b7f217d5aef7d946a488c3e547b097ed9f54ed1025c015853e47c9c8ad8a96fda821701c09914a49a02adb7ffc4461dc14817cc7ee9942ee134d5e313cfd

  • SSDEEP

    1536:71sMveb4lR0daHy9v7Zc86y9U4AFRfBWAEnV:BDeb4T0daHy9DZc86yGUtnV

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
  • Detects executables packed with ASPack 22 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 20 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe
    "C:\Users\Admin\AppData\Local\Temp\fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\recycled\SVCHOST.EXE
      C:\recycled\SVCHOST.EXE :agent
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2472
      • C:\recycled\SVCHOST.EXE
        C:\recycled\SVCHOST.EXE :agent
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2520
      • F:\recycled\SVCHOST.EXE
        F:\recycled\SVCHOST.EXE :agent
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2792
        • C:\recycled\SVCHOST.EXE
          C:\recycled\SVCHOST.EXE :agent
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2592
        • F:\recycled\SVCHOST.EXE
          F:\recycled\SVCHOST.EXE :agent
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2628
        • C:\recycled\SPOOLSV.EXE
          C:\recycled\SPOOLSV.EXE :agent
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Enumerates connected drives
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2364
          • C:\recycled\SVCHOST.EXE
            C:\recycled\SVCHOST.EXE :agent
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2876
          • F:\recycled\SVCHOST.EXE
            F:\recycled\SVCHOST.EXE :agent
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:644
          • C:\recycled\SPOOLSV.EXE
            C:\recycled\SPOOLSV.EXE :agent
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:572
      • C:\recycled\SPOOLSV.EXE
        C:\recycled\SPOOLSV.EXE :agent
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1916
      • C:\Windows\SysWOW64\userinit.exe
        C:\Windows\system32\userinit.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          4⤵
            PID:1664
      • F:\recycled\SVCHOST.EXE
        F:\recycled\SVCHOST.EXE :agent
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2596
      • C:\recycled\SPOOLSV.EXE
        C:\recycled\SPOOLSV.EXE :agent
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2712
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\fedf910a57f7c18215a0d93fb0347f5b99168d03c82bc1843127c571016add5c.doc"
        2⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:1128

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt

      Filesize

      1KB

      MD5

      0269b6347e473980c5378044ac67aa1f

      SHA1

      c3334de50e320ad8bce8398acff95c363d039245

      SHA256

      68f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2

      SHA512

      e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b

    • C:\begolu.txt

      Filesize

      2B

      MD5

      2b9d4fa85c8e82132bde46b143040142

      SHA1

      a02431cf7c501a5b368c91e41283419d8fa9fb03

      SHA256

      4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142

      SHA512

      c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be

    • F:\Recycled\SVCHOST.EXE

      Filesize

      89KB

      MD5

      8e1b10c7e1e50c4fe85cdb1864a5a73d

      SHA1

      7b8bde9b5d26e87afe890ee7a25cf5e300f0dba7

      SHA256

      8455a6c893ac05087e0c185a2950efa3205e397560fdd6c43c4b657901d4bbd3

      SHA512

      008f021902141f1e43c56149bdc71db940fe897ba2e58ba35716e5950c6477a0f7355d521215c530d5be3e79516f74abbc370d14f02dca16e89843d20b167a35

    • \Recycled\SPOOLSV.EXE

      Filesize

      89KB

      MD5

      e0b8ab1f8464997a9020aa24aad27489

      SHA1

      107cd2088257064adaa1d6344696bfc8b3f58715

      SHA256

      47b8b0eb4c83a0a86348f8b341bd1ce51e84d633086572e9f759b519fe2696c3

      SHA512

      1c67980938d73bac5345d48db993f851f42178f7b813b4d712158de62fab56ce2814f9733f00f8c3bff7899cfa52a379e941c0ae774afb199764ff86a1b3bc2f

    • \Recycled\SVCHOST.EXE

      Filesize

      89KB

      MD5

      b7b0f76351134540dd6c1a768b8d161f

      SHA1

      992fb326344dda87818991b5eebc6e6083105fbb

      SHA256

      9d91e22e358fa941a2bb9ab2e5fb23af07e0ff853f44738c5619d5bf3b780b02

      SHA512

      efda314e1301fe0448e59a771622b233181c73dd6d356086195382c408dab319c1125a2474193a12a16f79b2ecd41b57bda29afb8f1a2d48f3ada97d282b4035

    • memory/572-87-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/644-84-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/1128-111-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1916-94-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/1916-95-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/2364-72-0x00000000005C0000-0x00000000005DA000-memory.dmp

      Filesize

      104KB

    • memory/2364-64-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/2364-79-0x00000000005C0000-0x00000000005DA000-memory.dmp

      Filesize

      104KB

    • memory/2472-38-0x00000000024B0000-0x00000000024CA000-memory.dmp

      Filesize

      104KB

    • memory/2472-41-0x00000000024B0000-0x00000000024CA000-memory.dmp

      Filesize

      104KB

    • memory/2472-93-0x00000000024B0000-0x00000000024CA000-memory.dmp

      Filesize

      104KB

    • memory/2472-24-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/2472-141-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/2520-37-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/2520-32-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/2592-54-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/2596-101-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/2628-60-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/2628-55-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/2712-104-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/2712-107-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/2792-48-0x0000000002570000-0x000000000258A000-memory.dmp

      Filesize

      104KB

    • memory/2792-63-0x0000000002570000-0x000000000258A000-memory.dmp

      Filesize

      104KB

    • memory/2876-76-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/2896-0-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/2896-108-0x00000000041B0000-0x00000000041C0000-memory.dmp

      Filesize

      64KB

    • memory/2896-110-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/2896-109-0x0000000000460000-0x000000000047A000-memory.dmp

      Filesize

      104KB

    • memory/2896-23-0x0000000000460000-0x000000000047A000-memory.dmp

      Filesize

      104KB

    • memory/2896-17-0x0000000000460000-0x000000000047A000-memory.dmp

      Filesize

      104KB