Analysis

  • max time kernel
    100s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 06:29

General

  • Target

    140ae024f75372769c150d5b2303406bfcbc93255b9e9eb8144ce6e95b88e158.exe

  • Size

    66KB

  • MD5

    9d48b8167d7fadc73f79761e35f74d48

  • SHA1

    aab310300650655d26f00b95e4125116c6d97259

  • SHA256

    140ae024f75372769c150d5b2303406bfcbc93255b9e9eb8144ce6e95b88e158

  • SHA512

    9ee050b5d1c4340bf3066ce494702a6289a54d627c618ad6aa41815082df92490b7246d4da4af6517f5ec0863744d68f7672526c1879ac2b614fc5c9138c4a17

  • SSDEEP

    1536:pKtjk3SHuJV9N2rxzqWPBo+iESkTVL28+:pKtjkkuJVL2xvC

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1192
      • C:\Users\Admin\AppData\Local\Temp\140ae024f75372769c150d5b2303406bfcbc93255b9e9eb8144ce6e95b88e158.exe
        "C:\Users\Admin\AppData\Local\Temp\140ae024f75372769c150d5b2303406bfcbc93255b9e9eb8144ce6e95b88e158.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2028
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$a1FC0.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1284
          • C:\Users\Admin\AppData\Local\Temp\140ae024f75372769c150d5b2303406bfcbc93255b9e9eb8144ce6e95b88e158.exe
            "C:\Users\Admin\AppData\Local\Temp\140ae024f75372769c150d5b2303406bfcbc93255b9e9eb8144ce6e95b88e158.exe"
            4⤵
            • Executes dropped EXE
            PID:3048
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1428
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2292
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2456

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

              Filesize

              254KB

              MD5

              9fff503fad7fa1d9cc7453fdf86ff0e0

              SHA1

              f9b728ba2e8bf2b3a570583f06b0fd7e9fce4ef2

              SHA256

              826148f8b31a5372a71adf8f51961e1b59de63c8865393feffb99ece5e113147

              SHA512

              c00773863ea4b6d88ba1c5a9dcfd2f1033e540c854f2f041bb193f367a9153d54d9fcec0c71e4e9834bbe98a6a5be030b045d34e3b54d69cddfd4d427895af4f

            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

              Filesize

              92KB

              MD5

              69d52019abaf47f4b6743c611f5d69a7

              SHA1

              84dc1120ef31ac4073ad2df0f422b0c9cdc95413

              SHA256

              77d8e9a06f152f8cb1a1e9d6d3b3b04908d81424fed1d44e0f2f51b59c1b4a37

              SHA512

              1648a31f3a2a2f51beb29e0745225ab532d9e6b68e63e22f00d6484191bbf0a63ab6a1744f3f0be335b4cc6da2d3936c7d9c153213d3660896fdf1760e65d78e

            • C:\Users\Admin\AppData\Local\Temp\$$a1FC0.bat

              Filesize

              722B

              MD5

              2b158d57b224908202b476f1064713b9

              SHA1

              054e8fea52370f17f30018ff19d6e1a5eee2c69f

              SHA256

              96271c0af7cf74b54ef1164f5a56ea59fbc674bebf899dd81e7ec90db9f0ccc4

              SHA512

              0cb6f57d31f44306636549da565597b9ee10967e988e1782bcc3ab89dce96ab2d8208f5f721ff159b7259c27c0d5465d971d48c82aea122a56f32af9669d8d29

            • C:\Users\Admin\AppData\Local\Temp\140ae024f75372769c150d5b2303406bfcbc93255b9e9eb8144ce6e95b88e158.exe.exe

              Filesize

              36KB

              MD5

              2f3281171bcf4f0ccc156a4bec47e3c4

              SHA1

              903ef99e22ad9a52c0721dd9bdcc7b1a7712a31a

              SHA256

              1216e60740757fe5d3b8592547b94c09852df0d17e2ab1fc473808de8d0cd890

              SHA512

              a068fc04d2bca8d6901ef2b591d9017126a846a4268a68420ec1c17dd78010d88d6e0838ed01ff78fb1ca7b368826dbb92f72d194c02e21f404791ba5d9f0bbe

            • C:\Windows\Logo1_.exe

              Filesize

              29KB

              MD5

              2a84a41363c8f33192d48cfc5b1459b5

              SHA1

              6b4795876d91e6600070db0f75483a262ffb2f5b

              SHA256

              67c355070d3e00939065d2c9f0ecff9ebdaf89e4913f4584e8d576988b3b0866

              SHA512

              51eaa45d30d89b392c3ba6436b31424115d5cfd5d009a5ce5ed2a55eded885d7bd63e6236196dd7bcd2b8613d14a0b89ad6dfbad2aa25b1ced7d74ab3d905f44

            • F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\_desktop.ini

              Filesize

              9B

              MD5

              60b1ffe4d5892b7ae054738eec1fd425

              SHA1

              80d4e944617f4132b1c6917345b158f3693f35c8

              SHA256

              5e9944cc48c7ec641cf7b1b0125f47f26102c371a973612f0583f604bc3900d4

              SHA512

              7f5c200924dbb5531df997e6a35cb94f36b54f5651284b0d6404f0576301125ef72b410a170fca889d46c033063663cfc7791f9e4c3c30695af069053eee66cc

            • memory/1192-31-0x0000000002560000-0x0000000002561000-memory.dmp

              Filesize

              4KB

            • memory/1428-34-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/1428-1852-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/1428-3312-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/1428-21-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/1428-2224-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/1428-41-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/1428-47-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/1428-93-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/1428-99-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/1428-618-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/2028-0-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/2028-17-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/3048-29-0x0000000000840000-0x000000000084E000-memory.dmp

              Filesize

              56KB

            • memory/3048-28-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

              Filesize

              4KB

            • memory/3048-33-0x0000000074C10000-0x00000000752FE000-memory.dmp

              Filesize

              6.9MB