Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 22:32

General

  • Target

    9760f2e8aa488761a0086d8c1d015d250d11c9c2b468c0c6786502c5f48bf788.exe

  • Size

    27KB

  • MD5

    3262af3b3175a752b3dc89d5befd082f

  • SHA1

    e21b1e0a8298ce207987bf3479d995516ffb1c4a

  • SHA256

    9760f2e8aa488761a0086d8c1d015d250d11c9c2b468c0c6786502c5f48bf788

  • SHA512

    c2a167c48d803b206f5235cd61ab0f165241fe50d31f0471a117d692d7b3cd87a546ed2e03c7e6c261d0887ea77960e69ae48788cd5289c8142a1ba97a60b720

  • SSDEEP

    384:MYV1Gt5M0zhIV/DZ3KZp7JcTO4yf9KFL/KaUUqd3qR+FlYTj9QTN0wpD9p5Cs:l16GVRu1yK9fMFLKaTxsujCT7pZpY

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1088
      • C:\Users\Admin\AppData\Local\Temp\9760f2e8aa488761a0086d8c1d015d250d11c9c2b468c0c6786502c5f48bf788.exe
        "C:\Users\Admin\AppData\Local\Temp\9760f2e8aa488761a0086d8c1d015d250d11c9c2b468c0c6786502c5f48bf788.exe"
        2⤵
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2192
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2812
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:2000

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\7-Zip\7zFM.exe

        Filesize

        957KB

        MD5

        306b6e050e9418030e0ef49db759dbfd

        SHA1

        18a24c3d62330828649d40f5c05dd1e51a0781e6

        SHA256

        71541f32f6d9845c854ec99b894c5232960c50d010e0d6c1c1f979454d26310b

        SHA512

        8aece85fed0ae9a5ef340e4592ffbc30e5236edd84ddeb0eeec849c08f595b90912153995be965d51248440e565310048f378d091e914a10bcdfa069cc46fa6a

      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

        Filesize

        472KB

        MD5

        88eb1bca8c399bc3f46e99cdde2f047e

        SHA1

        55fafbceb011e1af2edced978686a90971bd95f2

        SHA256

        42fd78c05bc240d4ded16ac974f17c336f6ae3a1814d548021c48a942cc30428

        SHA512

        149d4de0c024e25a13a7bb17471e6f48391d4f26b1c8388672320eed1c255f84219ad7b72bbebc531ae558d5192dd4bb6d0dddd6c65a45300c8e8348a4fb3728

      • F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\_desktop.ini

        Filesize

        8B

        MD5

        af485d3db9f82d3e5bdc8c6d87fb742e

        SHA1

        f879c3dbd3d34e9789ff73896508bfbeabbf7468

        SHA256

        7a7b688ede50bbaf08d4579fbd8c6b6c99d9dd1206d95ab24d8174eb9be98759

        SHA512

        d5fe5155948320ef6d3f80c01c9a81f0d4f60bab381d921ab2e06b62475618b973b34346bd41b40af24f2b5aff64bba68710f405f7ff21a58f369acbaaee9360

      • memory/1088-5-0x00000000024A0000-0x00000000024A1000-memory.dmp

        Filesize

        4KB

      • memory/2192-66-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2192-20-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2192-0-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2192-72-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2192-14-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2192-578-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2192-1825-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2192-2271-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2192-3285-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2192-7-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB