Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 21:46

General

  • Target

    VirusShare_684fda3866eb6967ede8bd784ad90680.exe

  • Size

    684KB

  • MD5

    684fda3866eb6967ede8bd784ad90680

  • SHA1

    60531a62f6af7589949ac5d06ceb2a32665bf42f

  • SHA256

    83cd26fc0f2642307179d45e3cfb8610fe2451d4d3d5abdca2521d22e35db6ca

  • SHA512

    e2eb71a011d9a2cb465e21f9fabbcfb166c64b8618bad6694d82f42f8622024b71d467fcc25ef4f59bbc429a7330ac461c617ae1084e26eb644bf27b65af05bf

  • SSDEEP

    12288:8frDGo0iNyUl8n+OnrwF/w64BnxgLWIBwRnEmbbFdjqWeANhYnjg51s7h:Kr6o0iNyU+ntrwFI6QnqLWIYnfbzjqmk

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Users\Admin\AppData\Roaming\9iDEKdVR\WindowsSecurityUpdate.exe
      "C:\Users\Admin\AppData\Roaming\9iDEKdVR\WindowsSecurityUpdate.exe" -services
      2⤵
      • Executes dropped EXE
      PID:2680

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\Desktop\System Doctor 2014 support.url

          Filesize

          112B

          MD5

          d201abad2d2dca1ccd401e4419421267

          SHA1

          773e9bc9f8adc19db7bf4cb45e66765a2c0da0d8

          SHA256

          85a638446470746e8b6329fa052c8e3a9e3e53ba6e800228498f524778d5fb5a

          SHA512

          75c585d579b4cef4d0f124f2d6eb01482747a591f5ea708f53d717fc810c9c830519dc0742d26f523f4214ca791e1b5c200b45a1654f6bd044b0b4e1f9a11856

        • \Users\Admin\AppData\Roaming\9iDEKdVR\WindowsSecurityUpdate.exe

          Filesize

          684KB

          MD5

          684fda3866eb6967ede8bd784ad90680

          SHA1

          60531a62f6af7589949ac5d06ceb2a32665bf42f

          SHA256

          83cd26fc0f2642307179d45e3cfb8610fe2451d4d3d5abdca2521d22e35db6ca

          SHA512

          e2eb71a011d9a2cb465e21f9fabbcfb166c64b8618bad6694d82f42f8622024b71d467fcc25ef4f59bbc429a7330ac461c617ae1084e26eb644bf27b65af05bf

        • memory/1580-62-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

        • memory/1580-26-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

        • memory/1580-30-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

        • memory/1580-1-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

        • memory/1580-0-0x0000000000370000-0x0000000000374000-memory.dmp

          Filesize

          16KB

        • memory/1580-63-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

        • memory/1580-64-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

        • memory/1580-65-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

        • memory/2680-17-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

        • memory/2680-22-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

        • memory/2680-24-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB