Analysis

  • max time kernel
    149s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 06:29

General

  • Target

    66e7cf0074df6f8113d916150df7020efa7d4331e1fca3a8e8dd970c308b8ddf.exe

  • Size

    5.7MB

  • MD5

    ffdedf9f01400fa60aec00a05f2fe5b8

  • SHA1

    ea5f90c4a7a9845aed022a6c1e43950fc1476e5c

  • SHA256

    66e7cf0074df6f8113d916150df7020efa7d4331e1fca3a8e8dd970c308b8ddf

  • SHA512

    07f1cb62dcc38a7dfc2e116df0d7657892c447dfdcace523533281a4b4b2ac2a0840e8cfe7d419d7aaea4b8826f15f14a46f36164a511af4c71ecec02a0e7db0

  • SSDEEP

    49152:jPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBJ:rKUgTH2M2m9UMpu1QfLczqssnKSk

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3412
      • C:\Users\Admin\AppData\Local\Temp\66e7cf0074df6f8113d916150df7020efa7d4331e1fca3a8e8dd970c308b8ddf.exe
        "C:\Users\Admin\AppData\Local\Temp\66e7cf0074df6f8113d916150df7020efa7d4331e1fca3a8e8dd970c308b8ddf.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4996
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5004.bat
          3⤵
            PID:2296
            • C:\Users\Admin\AppData\Local\Temp\66e7cf0074df6f8113d916150df7020efa7d4331e1fca3a8e8dd970c308b8ddf.exe
              "C:\Users\Admin\AppData\Local\Temp\66e7cf0074df6f8113d916150df7020efa7d4331e1fca3a8e8dd970c308b8ddf.exe"
              4⤵
              • Executes dropped EXE
              PID:1620
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2400
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4404
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:1624

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

                Filesize

                254KB

                MD5

                9fff503fad7fa1d9cc7453fdf86ff0e0

                SHA1

                f9b728ba2e8bf2b3a570583f06b0fd7e9fce4ef2

                SHA256

                826148f8b31a5372a71adf8f51961e1b59de63c8865393feffb99ece5e113147

                SHA512

                c00773863ea4b6d88ba1c5a9dcfd2f1033e540c854f2f041bb193f367a9153d54d9fcec0c71e4e9834bbe98a6a5be030b045d34e3b54d69cddfd4d427895af4f

              • C:\Program Files\7-Zip\7z.exe

                Filesize

                448KB

                MD5

                8d8715c87a2cb853487aea6cd7400bde

                SHA1

                85bbc8edd7f5a99cf13e75e2df48c0d41e62fa7f

                SHA256

                d3b5c031761699a91b97afb5aab4c5a651810612ac4caaa38fc9adcf4be95080

                SHA512

                052307804dec7d1bf2fb99e297ddef910f8d42dcbd4106eb3c84c4a5980e896d936e0f25422dd2ed5190174fc920a18c7e589b18b321bdd57280c67e10f76b59

              • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

                Filesize

                639KB

                MD5

                c168f1400f09b767044170c5c0603287

                SHA1

                806b134d2145304a602bc358c2664cc266a52aeb

                SHA256

                05d52614bdae4496eb435a35b3eb91cc424abb582fdaaae8a8f96a3cf34e2676

                SHA512

                532f698580361daa78290a7871c1a58fd6e9a445ec78224f7b90bea454fb15183eaa9cee1ef9dcf3fb30a56b5fa6e57de67b817fe04cd5bd61ca5e6710f8f9a1

              • C:\Users\Admin\AppData\Local\Temp\$$a5004.bat

                Filesize

                722B

                MD5

                62019ba06e7040e9d87bba27d275af85

                SHA1

                a5b867ff91f4b93c4cfc38d982a485a678241f20

                SHA256

                29ae213d49e96668e3657b7205617964b9ba4b6a3385dab2873be0224cb57403

                SHA512

                12199f6648b2721d6bcea96fd3f4093419bef848b94929500d8f371a898b771396a3f83fe0a0b804faf8ff01d752748997d57d40427bd4aebd9a16ef77acf4f3

              • C:\Users\Admin\AppData\Local\Temp\66e7cf0074df6f8113d916150df7020efa7d4331e1fca3a8e8dd970c308b8ddf.exe.exe

                Filesize

                5.7MB

                MD5

                ba18e99b3e17adb5b029eaebc457dd89

                SHA1

                ec0458f3c00d35b323f08d4e1cc2e72899429c38

                SHA256

                f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628

                SHA512

                1f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c

              • C:\Windows\rundl132.exe

                Filesize

                29KB

                MD5

                ba189b5e31c56a2e16e9c7accf623760

                SHA1

                52470f4d5e556832e9e4ff4625751ae62219d0ee

                SHA256

                037c1fc35982012dddedd497646d12ef35654415a14d4bbd467dca672954a3ed

                SHA512

                8da8c08b8af3450f715d2a04b492f2f459a93695bdf7514441705d041d5aba0df6edbb7a5e69e9a8bcbabd9f3c692e2522365ef2e889db3857043118c6df05b0

              • F:\$RECYCLE.BIN\S-1-5-21-2804150937-2146708401-419095071-1000\_desktop.ini

                Filesize

                9B

                MD5

                60b1ffe4d5892b7ae054738eec1fd425

                SHA1

                80d4e944617f4132b1c6917345b158f3693f35c8

                SHA256

                5e9944cc48c7ec641cf7b1b0125f47f26102c371a973612f0583f604bc3900d4

                SHA512

                7f5c200924dbb5531df997e6a35cb94f36b54f5651284b0d6404f0576301125ef72b410a170fca889d46c033063663cfc7791f9e4c3c30695af069053eee66cc

              • memory/2400-27-0x0000000000400000-0x0000000000436000-memory.dmp

                Filesize

                216KB

              • memory/2400-33-0x0000000000400000-0x0000000000436000-memory.dmp

                Filesize

                216KB

              • memory/2400-37-0x0000000000400000-0x0000000000436000-memory.dmp

                Filesize

                216KB

              • memory/2400-20-0x0000000000400000-0x0000000000436000-memory.dmp

                Filesize

                216KB

              • memory/2400-1231-0x0000000000400000-0x0000000000436000-memory.dmp

                Filesize

                216KB

              • memory/2400-4797-0x0000000000400000-0x0000000000436000-memory.dmp

                Filesize

                216KB

              • memory/2400-11-0x0000000000400000-0x0000000000436000-memory.dmp

                Filesize

                216KB

              • memory/2400-5236-0x0000000000400000-0x0000000000436000-memory.dmp

                Filesize

                216KB

              • memory/4996-0-0x0000000000400000-0x0000000000436000-memory.dmp

                Filesize

                216KB

              • memory/4996-10-0x0000000000400000-0x0000000000436000-memory.dmp

                Filesize

                216KB