Analysis

  • max time kernel
    149s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 23:42

General

  • Target

    4f0e4f648fe4146d3e8f42e1da12606cde8c423a35556729d5069e241a0c1b5c.exe

  • Size

    66KB

  • MD5

    a878b58aacb81b190eb1c0a7de1df471

  • SHA1

    801d617704eb88f0c6c3fb243ae189494b6964af

  • SHA256

    4f0e4f648fe4146d3e8f42e1da12606cde8c423a35556729d5069e241a0c1b5c

  • SHA512

    5533b38cdfe0f9412967278b958fc13fc9b494ac7c9f062633217a51f6bc8ae20b8a9602161c4d27d34c539aade1feeeae226656967b094ef2cf231957a1cf02

  • SSDEEP

    1536:kIfgLdQAQfcfymNg33CLlAJmiRTOlfm7dxh:/ftffjmN83kAJJaMh

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3400
      • C:\Users\Admin\AppData\Local\Temp\4f0e4f648fe4146d3e8f42e1da12606cde8c423a35556729d5069e241a0c1b5c.exe
        "C:\Users\Admin\AppData\Local\Temp\4f0e4f648fe4146d3e8f42e1da12606cde8c423a35556729d5069e241a0c1b5c.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1604
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BFD.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:116
          • C:\Users\Admin\AppData\Local\Temp\4f0e4f648fe4146d3e8f42e1da12606cde8c423a35556729d5069e241a0c1b5c.exe
            "C:\Users\Admin\AppData\Local\Temp\4f0e4f648fe4146d3e8f42e1da12606cde8c423a35556729d5069e241a0c1b5c.exe"
            4⤵
            • Executes dropped EXE
            PID:2728
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:436
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4472
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:3920

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        251KB

        MD5

        f94afa1cae163777a4ead07058d9b026

        SHA1

        f9076e8e06e3f5eaf76ce771473be0b0045fc3e9

        SHA256

        cd34b8f29d1c48674d4079c529efef3554200bfcef576bb55a2e3f03ce0f2362

        SHA512

        54be6fb01f76381ecde1f9cbe7d8d80f23622833bd89e6cfd3506942aa19387acf77c9b96fb6b3375f83158c51c2b6369071a155cb084f2f92cc4ae3286c4f18

      • C:\Program Files\DisconnectAdd.exe

        Filesize

        317KB

        MD5

        b1d0c7ad56549e53cc860796162d55a5

        SHA1

        52a94b46b04686ad4cc41b86c61833765aab7d93

        SHA256

        7c377bc1ae973ebce38c5f3d473227fb647c3ab21957a937e27ea91e2fd96603

        SHA512

        77ef248a25ac77094a36fa4eca07e512f0b707d08b383829dfca3acb0eb707e446c059f71bab10a6348cab3c8c640fe3a798219107a81bc183296ca6af4f872f

      • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

        Filesize

        636KB

        MD5

        2500f702e2b9632127c14e4eaae5d424

        SHA1

        8726fef12958265214eeb58001c995629834b13a

        SHA256

        82e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c

        SHA512

        f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c

      • C:\Users\Admin\AppData\Local\Temp\$$a4BFD.bat

        Filesize

        722B

        MD5

        b54edc6369ccd03d5500538b879e526f

        SHA1

        e117e44892e553db7bafe11d024b97b9d79f7372

        SHA256

        518488543a3e4ab5a2a1f535b48680af1b94dd1e4e92992c919dcfe6ca1cef64

        SHA512

        41d2ff530ace2cd8adce60c2e969937e04a80f160e30fd1640cd640e1bca85c6e6c7b5c399be08a8b6e7e05b2ce79c48edb4401fa9e4ad3619aea7edb04a7edb

      • C:\Users\Admin\AppData\Local\Temp\4f0e4f648fe4146d3e8f42e1da12606cde8c423a35556729d5069e241a0c1b5c.exe.exe

        Filesize

        40KB

        MD5

        1bd1483a7c02d3c1b41b9b1c267ce18a

        SHA1

        5106e8b8e4c292ba6aa53e85755e42b721f4d8c7

        SHA256

        97fe1e3fd8bd54531af1d0ec7a41428a5767ff205e3629deb0e7f6dd1d8e52ce

        SHA512

        e0380278791f8e0c3c67375e2c9b39f9f4485698565f6f91e70b3223b8232ad842e87ad3b7e1e92c31f0e92d27e6b51102576a6ae788957b5b4e3a1fccc3f925

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        d1bd53e7079e1416e563b6787c74f3f8

        SHA1

        dfbb7850f591cc74bcbe86418b5ef11522e9e7b0

        SHA256

        b4a3413d2027dc45862a0959c413db5f6b7e932c3c61660c2c3df78804d1db2e

        SHA512

        bacb9edc071341e8ea9dfd8309126f1bc29dbcc9b0cb4a9212b9ad6f6381bc2aae8f9c300eeb3e17e1519d90456e651270e316497daa5ed0f23b69a10fdd129f

      • F:\$RECYCLE.BIN\S-1-5-21-3558294865-3673844354-2255444939-1000\_desktop.ini

        Filesize

        9B

        MD5

        1f206a052c160fd77308863abd810887

        SHA1

        3b27ec1dc4b51fb7f1793a9ca9bb0d2e53e60eb1

        SHA256

        45129bd309ca763a88c6bf438896e82b939d6491036658c4512c57f8353938c1

        SHA512

        bd7857c146b01a49d34d4eb84053353eeb586bee6916426179305d5e2360559adea4040fe2184a3a803943ff4e6526cc38c665f9a808355619628868d53fbed5

      • memory/436-27-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/436-33-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/436-37-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/436-20-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/436-1232-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/436-4798-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/436-13-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/436-5237-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1604-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1604-9-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB