Analysis

  • max time kernel
    111s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 06:29

General

  • Target

    0a27c0d3eecafc5bdd1690a669ac6fa22398b72143309605b7a6e964a75cfb2a.exe

  • Size

    954KB

  • MD5

    2504e1898b774412970a40eb0384e6d0

  • SHA1

    a66afeeb56ea11fa6c848a68c27e0e3a4b5c40dc

  • SHA256

    0a27c0d3eecafc5bdd1690a669ac6fa22398b72143309605b7a6e964a75cfb2a

  • SHA512

    3526593c39da3445051b764331a1b02d2e2223ae52e45abd53b836b7e4f100c004adbda1a487aeb6b1a9a37ea5595e44299ae59ac36559c5db2cc72adb484c04

  • SSDEEP

    24576:r7cvC8GHhLAMrIYnoa0upI3H/Po63LjUcF1/:r7cvCPGMhn8Pb7

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3376
      • C:\Users\Admin\AppData\Local\Temp\0a27c0d3eecafc5bdd1690a669ac6fa22398b72143309605b7a6e964a75cfb2a.exe
        "C:\Users\Admin\AppData\Local\Temp\0a27c0d3eecafc5bdd1690a669ac6fa22398b72143309605b7a6e964a75cfb2a.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4060
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD532.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:100
          • C:\Users\Admin\AppData\Local\Temp\0a27c0d3eecafc5bdd1690a669ac6fa22398b72143309605b7a6e964a75cfb2a.exe
            "C:\Users\Admin\AppData\Local\Temp\0a27c0d3eecafc5bdd1690a669ac6fa22398b72143309605b7a6e964a75cfb2a.exe"
            4⤵
            • Executes dropped EXE
            PID:2780
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3104
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1956
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:3760
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:3916

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

                Filesize

                251KB

                MD5

                099be1f135daaba3e2a8198ee3502b2a

                SHA1

                a792724c7592d07434bfc6ed5151f23966e73924

                SHA256

                773c644013e8b8fe0321403099693f0ab941283b381a178716049afc92cb63a1

                SHA512

                371f1d56f64091b3c0b08353797e353f22b2e73423243ea2ef5a9d91853331e90d2512e591163100c68df38549912b87a13abbb2c5520684b44ee2032e935366

              • C:\Program Files\7-Zip\7z.exe

                Filesize

                570KB

                MD5

                badb9005aff0ac965a63969ff04438f9

                SHA1

                4ed0a9f6b83e0aca5c3807a83cb17d2fd7e5d165

                SHA256

                7e9d99e9ba0e2bce9e46c3d7a757c5abcce5491143fc6288a21d4cac6849b67c

                SHA512

                fe17f00e6e35dd81862a82afd2a396c159d2b090b6fee235b268f9feacf9aec58113a355a04f5f368230bea77548890ae38a287bf626e03d029f293158c59687

              • C:\Users\Admin\AppData\Local\Temp\$$aD532.bat

                Filesize

                722B

                MD5

                fecbb5904927d913c7b39c5b700072ea

                SHA1

                0470f24d58de892788f8f438911ade8158d74f26

                SHA256

                c392991de4e550cdfc97408f8c4daa06e471f0bbd746b4230dde0f5d93c9570d

                SHA512

                e69e312d7de6edce12c806bf3b5ae4ccb3d3e114738e3d43baecc4570bcda2101d662cb517d03eaf0aaab265b65f4c9c7c97829a4b418232a6c1961256849fbd

              • C:\Users\Admin\AppData\Local\Temp\0a27c0d3eecafc5bdd1690a669ac6fa22398b72143309605b7a6e964a75cfb2a.exe.exe

                Filesize

                928KB

                MD5

                9ae85ec1fa398ef12c39c3e2d466c503

                SHA1

                5beb85be6228b5dc0f34cf7375bcf4d9f83fa06a

                SHA256

                6ee75ac40a41d2717762117cd9649ed1780aa67769dbbb84ef508b76d75a19c3

                SHA512

                2e0b1e79c34209fd9c3e2b65da62d370225b7499c57cb0a7bf5c306e7f99a0ad6493b493eeca99a460ba051b907517c9423cff46ea80b13f1081144849fad7eb

              • C:\Windows\rundl132.exe

                Filesize

                26KB

                MD5

                7c15205a07dd533f95522e5ffdfea7c4

                SHA1

                69ca1e1a8b842a8795c164376518add592d6b63b

                SHA256

                dd66c57aa3dab4a1879b1cbf49e4bb77df174a145cd3b7adbe021ab3f02795db

                SHA512

                d388c426086a683dd50d18cdf3151ee8b62f5b057dd73a4eba56c5866b2b09c10dba2e7501ee2972f69782f08fdca13b7c37eb887f95c6de2f5622b982d74f65

              • F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\_desktop.ini

                Filesize

                9B

                MD5

                60b1ffe4d5892b7ae054738eec1fd425

                SHA1

                80d4e944617f4132b1c6917345b158f3693f35c8

                SHA256

                5e9944cc48c7ec641cf7b1b0125f47f26102c371a973612f0583f604bc3900d4

                SHA512

                7f5c200924dbb5531df997e6a35cb94f36b54f5651284b0d6404f0576301125ef72b410a170fca889d46c033063663cfc7791f9e4c3c30695af069053eee66cc

              • memory/2780-21-0x0000000000400000-0x00000000004EE000-memory.dmp

                Filesize

                952KB

              • memory/2780-18-0x0000000002140000-0x0000000002141000-memory.dmp

                Filesize

                4KB

              • memory/2780-30-0x0000000002140000-0x0000000002141000-memory.dmp

                Filesize

                4KB

              • memory/3104-20-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/3104-31-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/3104-37-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/3104-46-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/3104-50-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/3104-1193-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/3104-9-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/3104-4923-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/4060-0-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB

              • memory/4060-12-0x0000000000400000-0x0000000000434000-memory.dmp

                Filesize

                208KB