Analysis

  • max time kernel
    143s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    09/06/2024, 07:32

General

  • Target

    6f14b9eafd138cac9f2ab3edccb0b7a2cb20fde19300d017cba254bf7ffa904b.exe

  • Size

    1.6MB

  • MD5

    10412eb16380163f24eef3c9ec8086af

  • SHA1

    84e7ed7fbf5a564776924ae1bdf36b9038d8ffd2

  • SHA256

    6f14b9eafd138cac9f2ab3edccb0b7a2cb20fde19300d017cba254bf7ffa904b

  • SHA512

    a96d1ac5ac76971fefea3bf8beac817d335400da76b5dacb885039585ac1a8ee2b5d64c6b0de83b647f19ad00925c6b7ed61dc78b5211ef54aa4555bfccebbb9

  • SSDEEP

    6144:cVfjmNNztkAzkAZqrEdrEAZUCwFjNNzRFG:e7+TNPqrEdrE7RFG

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1196
      • C:\Users\Admin\AppData\Local\Temp\6f14b9eafd138cac9f2ab3edccb0b7a2cb20fde19300d017cba254bf7ffa904b.exe
        "C:\Users\Admin\AppData\Local\Temp\6f14b9eafd138cac9f2ab3edccb0b7a2cb20fde19300d017cba254bf7ffa904b.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2176
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$aD3A.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2368
          • C:\Users\Admin\AppData\Local\Temp\6f14b9eafd138cac9f2ab3edccb0b7a2cb20fde19300d017cba254bf7ffa904b.exe
            "C:\Users\Admin\AppData\Local\Temp\6f14b9eafd138cac9f2ab3edccb0b7a2cb20fde19300d017cba254bf7ffa904b.exe"
            4⤵
            • Executes dropped EXE
            PID:2624
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1680
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2572
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2652

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        251KB

        MD5

        505a6d58bf497236343021e7b0034d01

        SHA1

        990dd5f5430bb0247faec84532659a3abd02d175

        SHA256

        e704d8b1ef5ab127f7312aa99cd0bb7f7fe0d6bf64a247c943ce5fad3e389ce5

        SHA512

        18f68912c5e37601cff09c4b17441a28a14bfa4b8170ea08216a554ab9bf38c895c6864ffcc0481f83809e2197434452f1e69e9be33b4077942e2969ceb42c1f

      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

        Filesize

        471KB

        MD5

        4cfdb20b04aa239d6f9e83084d5d0a77

        SHA1

        f22863e04cc1fd4435f785993ede165bd8245ac6

        SHA256

        30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9

        SHA512

        35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

      • C:\Users\Admin\AppData\Local\Temp\$$aD3A.bat

        Filesize

        721B

        MD5

        69f8db53cf829987b33d45c9ef09672c

        SHA1

        756f16a3535a1ffe70285159819956e4a8c5beaa

        SHA256

        2c0ea8b522563ac8e5fd92c292b68f394da69987f4460832db63f1872ce7ca6e

        SHA512

        c5809d1f30c5a185f744b7f68129f6b1af0c2ac6a2bb95f9c38a7d7cfa453581a6de95685e7edab060c3c044f8b6dc85d995f16c17c908e82fab1303e62debc2

      • C:\Users\Admin\AppData\Local\Temp\6f14b9eafd138cac9f2ab3edccb0b7a2cb20fde19300d017cba254bf7ffa904b.exe.exe

        Filesize

        1.5MB

        MD5

        217599a88bc058877bcca5f75dfe55d3

        SHA1

        0a5088843680a8af17dc03a06eecbb6d143bb415

        SHA256

        3bbd4367c9caf48e6d2fcdb42db9b1da55ae4243205d1961e9e6ecc60978ca04

        SHA512

        a58098618662b3f14914cb1b897897a821f66bcec1fa89fa1af4d0dbf3480ac7c53dd7684739adb52a92ec5c0f587bf4c4ea7b7f3c01d765c6a582bd68cc0a46

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        16a25aa1146ec85df075ba1510f85564

        SHA1

        ee6817d101321f1cc58a16e306d352df1cb1b040

        SHA256

        d8cc4fa8f7d5c07a625985c45cb6b2a663b8bb533e2e3a96a1bde6716b4e8670

        SHA512

        b248affed14b7c92f7bf78c50cdc75ad29d49d2d883761c9440c1a7a185cea6e0aa5f7b8d363848af7eb51dad7727ec47b0991483f7f27c4d8a2833ae51ce80f

      • F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\_desktop.ini

        Filesize

        8B

        MD5

        9bf5ad0e8bbf0ba1630c244358e5c6dd

        SHA1

        25918532222a7063195beeb76980b6ec9e59e19a

        SHA256

        551cc5b618f0fa78108dd2388d9136893adb10499e4836e9728f4e96530bf02f

        SHA512

        7fdce76bb191d4988d92e3d97ce8db4cae1b5c1f93198bffc4e863d324d814246353200d32ea730f83345fcb7ad82213c2bcd31351e905e473d9596bc7b43ad3

      • memory/1196-30-0x0000000002560000-0x0000000002561000-memory.dmp

        Filesize

        4KB

      • memory/1680-550-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1680-32-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1680-39-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1680-45-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1680-91-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1680-97-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1680-1850-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1680-3310-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1680-19-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2176-15-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2176-17-0x00000000003C0000-0x00000000003F4000-memory.dmp

        Filesize

        208KB

      • memory/2176-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2176-18-0x00000000003C0000-0x00000000003F4000-memory.dmp

        Filesize

        208KB