Analysis

  • max time kernel
    150s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/06/2024, 07:32

General

  • Target

    6f14b9eafd138cac9f2ab3edccb0b7a2cb20fde19300d017cba254bf7ffa904b.exe

  • Size

    1.6MB

  • MD5

    10412eb16380163f24eef3c9ec8086af

  • SHA1

    84e7ed7fbf5a564776924ae1bdf36b9038d8ffd2

  • SHA256

    6f14b9eafd138cac9f2ab3edccb0b7a2cb20fde19300d017cba254bf7ffa904b

  • SHA512

    a96d1ac5ac76971fefea3bf8beac817d335400da76b5dacb885039585ac1a8ee2b5d64c6b0de83b647f19ad00925c6b7ed61dc78b5211ef54aa4555bfccebbb9

  • SSDEEP

    6144:cVfjmNNztkAzkAZqrEdrEAZUCwFjNNzRFG:e7+TNPqrEdrE7RFG

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3412
      • C:\Users\Admin\AppData\Local\Temp\6f14b9eafd138cac9f2ab3edccb0b7a2cb20fde19300d017cba254bf7ffa904b.exe
        "C:\Users\Admin\AppData\Local\Temp\6f14b9eafd138cac9f2ab3edccb0b7a2cb20fde19300d017cba254bf7ffa904b.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3008
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6522.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1492
          • C:\Users\Admin\AppData\Local\Temp\6f14b9eafd138cac9f2ab3edccb0b7a2cb20fde19300d017cba254bf7ffa904b.exe
            "C:\Users\Admin\AppData\Local\Temp\6f14b9eafd138cac9f2ab3edccb0b7a2cb20fde19300d017cba254bf7ffa904b.exe"
            4⤵
            • Executes dropped EXE
            PID:4236
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1380
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3972
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:4208

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        251KB

        MD5

        505a6d58bf497236343021e7b0034d01

        SHA1

        990dd5f5430bb0247faec84532659a3abd02d175

        SHA256

        e704d8b1ef5ab127f7312aa99cd0bb7f7fe0d6bf64a247c943ce5fad3e389ce5

        SHA512

        18f68912c5e37601cff09c4b17441a28a14bfa4b8170ea08216a554ab9bf38c895c6864ffcc0481f83809e2197434452f1e69e9be33b4077942e2969ceb42c1f

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        570KB

        MD5

        f7b58e900d8d07f4fd06d76326305cf9

        SHA1

        5891e9701df11a967b96ae7d85534715d79bc569

        SHA256

        6438d8093bfb4ab8daaa71a8e4a30bc25da53c77ae147b0220f1d532f109f24a

        SHA512

        3c59854ea132d4c376491ec1904cf518d8c5d1b366f9508f31af4bdfa3605d80578cf10dcbd4302d2002528081f19ba4dee7a1c227517aa05a4257f8b76f9f20

      • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

        Filesize

        636KB

        MD5

        2500f702e2b9632127c14e4eaae5d424

        SHA1

        8726fef12958265214eeb58001c995629834b13a

        SHA256

        82e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c

        SHA512

        f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c

      • C:\Users\Admin\AppData\Local\Temp\$$a6522.bat

        Filesize

        722B

        MD5

        ac888e4371f17c79e833da6139bc4bbc

        SHA1

        7865c4d5bfe5b8d7eb06f3bbb0d8844579112c5d

        SHA256

        dbdf71f02f5770af61f0f0ebf6333438bda4f3b9158815343af2223ce7010698

        SHA512

        0428106c3a636101458effbbe9d956ae41312a6870f71e4d9e34a978682dd9fc34d388cf8ab4daac5457560268bc45d0c1400d83d83b11c17972f39c5bfd3d36

      • C:\Users\Admin\AppData\Local\Temp\6f14b9eafd138cac9f2ab3edccb0b7a2cb20fde19300d017cba254bf7ffa904b.exe.exe

        Filesize

        1.5MB

        MD5

        217599a88bc058877bcca5f75dfe55d3

        SHA1

        0a5088843680a8af17dc03a06eecbb6d143bb415

        SHA256

        3bbd4367c9caf48e6d2fcdb42db9b1da55ae4243205d1961e9e6ecc60978ca04

        SHA512

        a58098618662b3f14914cb1b897897a821f66bcec1fa89fa1af4d0dbf3480ac7c53dd7684739adb52a92ec5c0f587bf4c4ea7b7f3c01d765c6a582bd68cc0a46

      • C:\Windows\rundl132.exe

        Filesize

        26KB

        MD5

        16a25aa1146ec85df075ba1510f85564

        SHA1

        ee6817d101321f1cc58a16e306d352df1cb1b040

        SHA256

        d8cc4fa8f7d5c07a625985c45cb6b2a663b8bb533e2e3a96a1bde6716b4e8670

        SHA512

        b248affed14b7c92f7bf78c50cdc75ad29d49d2d883761c9440c1a7a185cea6e0aa5f7b8d363848af7eb51dad7727ec47b0991483f7f27c4d8a2833ae51ce80f

      • F:\$RECYCLE.BIN\S-1-5-21-4124900551-4068476067-3491212533-1000\_desktop.ini

        Filesize

        8B

        MD5

        9bf5ad0e8bbf0ba1630c244358e5c6dd

        SHA1

        25918532222a7063195beeb76980b6ec9e59e19a

        SHA256

        551cc5b618f0fa78108dd2388d9136893adb10499e4836e9728f4e96530bf02f

        SHA512

        7fdce76bb191d4988d92e3d97ce8db4cae1b5c1f93198bffc4e863d324d814246353200d32ea730f83345fcb7ad82213c2bcd31351e905e473d9596bc7b43ad3

      • memory/1380-27-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1380-34-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1380-37-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1380-20-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1380-1231-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1380-13-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1380-4797-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1380-5236-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3008-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3008-12-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB