Analysis

  • max time kernel
    100s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 06:33

General

  • Target

    311e0908222b68ef5622539585ebffc10fef822f795e69ef54f8290bfb36162a.exe

  • Size

    88KB

  • MD5

    ed07f47538e98b0fafc3529f789db090

  • SHA1

    03cc8674aaf7efb02af042bcb59ad280e45eed3f

  • SHA256

    311e0908222b68ef5622539585ebffc10fef822f795e69ef54f8290bfb36162a

  • SHA512

    bbbc3a27685be6ae8a2af22d498fd96079288bdfd93cde3a423c5cbcbd948db319fc7fe6f2293f002b94f5ffe5db32c348f451daf46779e98d10dfd6534e3810

  • SSDEEP

    1536:pnJjk3SHuJV9Ntyapmebn4ddJZeY86iLflLJYEIs67rxo:pJjkkuJVL8LK4ddJMY86ipmns6S

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1232
      • C:\Users\Admin\AppData\Local\Temp\311e0908222b68ef5622539585ebffc10fef822f795e69ef54f8290bfb36162a.exe
        "C:\Users\Admin\AppData\Local\Temp\311e0908222b68ef5622539585ebffc10fef822f795e69ef54f8290bfb36162a.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1928
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$a2C5E.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2592
          • C:\Users\Admin\AppData\Local\Temp\311e0908222b68ef5622539585ebffc10fef822f795e69ef54f8290bfb36162a.exe
            "C:\Users\Admin\AppData\Local\Temp\311e0908222b68ef5622539585ebffc10fef822f795e69ef54f8290bfb36162a.exe"
            4⤵
            • Executes dropped EXE
            PID:2408
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2732
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2716
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2692

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

              Filesize

              192KB

              MD5

              c72fe4f8c15b04ef57e2d34d7a079caa

              SHA1

              ca11936d2d1d6ad47a3108e423235e6ac95f28cb

              SHA256

              b3a1ce36ab9e9055503a359aeaa874f514329126eb55146ffb072a31d23b3018

              SHA512

              9be0d93ae6d307f8806bd0b51d7d1f0328ca018929c3b4e5dc69e5dda24ef69a0a850602e13736e8a60213c8ede81e25041961bf4d3183b7876187660c79c8d7

            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

              Filesize

              411KB

              MD5

              9c1671821855ca12975573629ddd484a

              SHA1

              ba971ed691b0a86d1edcd8d6f1cbd1ceba8e6acb

              SHA256

              7441f57dcd2c39df50c7b9a40c858958f1ae0cf10eee1b8e348f8469a8cae3f8

              SHA512

              e3e26e0afbcdc285686d26187c2e39ff1716a794a58cd3615bcf4e3494a0cde80cc41f0be3ca4a87e0018f2c707599041dc86627a581b1c06297c7aab52d9c89

            • C:\Users\Admin\AppData\Local\Temp\$$a2C5E.bat

              Filesize

              722B

              MD5

              fede6aba9e5e5c669f577fef05d46d45

              SHA1

              3fc6274d96ebdb6ee319fe2332b94e697d4dcbd8

              SHA256

              f4a7681351e7c047a356915b33b7f7da0696ef31b968195bf9584e2adcc51c30

              SHA512

              0b16c5bacd0e0d5e6cf16852c7398cfd81529cd4d5ba804ca1862ae14f30094a9908cfb83aba4ae848df229e77e2aca1213a54f482b7757911fef865d0bb0d2b

            • C:\Users\Admin\AppData\Local\Temp\311e0908222b68ef5622539585ebffc10fef822f795e69ef54f8290bfb36162a.exe.exe

              Filesize

              59KB

              MD5

              dfc18f7068913dde25742b856788d7ca

              SHA1

              cbaa23f782c2ddcd7c9ff024fd0b096952a2b387

              SHA256

              ff4ac75c02247000da084de006c214d3dd3583867bd3533ba788e22734c7a2bf

              SHA512

              d0c7ec1dae41a803325b51c12490c355ed779d297daa35247889950491e52427810132f0829fc7ffa3022f1a106f4e4ba78ed612223395313a6f267e9ab24945

            • C:\Windows\Logo1_.exe

              Filesize

              29KB

              MD5

              ba189b5e31c56a2e16e9c7accf623760

              SHA1

              52470f4d5e556832e9e4ff4625751ae62219d0ee

              SHA256

              037c1fc35982012dddedd497646d12ef35654415a14d4bbd467dca672954a3ed

              SHA512

              8da8c08b8af3450f715d2a04b492f2f459a93695bdf7514441705d041d5aba0df6edbb7a5e69e9a8bcbabd9f3c692e2522365ef2e889db3857043118c6df05b0

            • F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\_desktop.ini

              Filesize

              9B

              MD5

              60b1ffe4d5892b7ae054738eec1fd425

              SHA1

              80d4e944617f4132b1c6917345b158f3693f35c8

              SHA256

              5e9944cc48c7ec641cf7b1b0125f47f26102c371a973612f0583f604bc3900d4

              SHA512

              7f5c200924dbb5531df997e6a35cb94f36b54f5651284b0d6404f0576301125ef72b410a170fca889d46c033063663cfc7791f9e4c3c30695af069053eee66cc

            • memory/1232-31-0x00000000024C0000-0x00000000024C1000-memory.dmp

              Filesize

              4KB

            • memory/1928-18-0x0000000000220000-0x0000000000256000-memory.dmp

              Filesize

              216KB

            • memory/1928-17-0x0000000000220000-0x0000000000256000-memory.dmp

              Filesize

              216KB

            • memory/1928-20-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/1928-0-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/2732-98-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/2732-46-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/2732-92-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/2732-40-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/2732-583-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/2732-1851-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/2732-2103-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/2732-33-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/2732-3311-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB

            • memory/2732-19-0x0000000000400000-0x0000000000436000-memory.dmp

              Filesize

              216KB