Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    12/06/2024, 04:52

General

  • Target

    b78112b8eced8b7e581730c13e55dd7e9a722acbe6c68f806883913d78142ad2.exe

  • Size

    6.0MB

  • MD5

    366bc6388245a3ae5a13a2bee4cd1b56

  • SHA1

    5ca5f8df4eb6a23f8a8c4909e314467cf38deb36

  • SHA256

    b78112b8eced8b7e581730c13e55dd7e9a722acbe6c68f806883913d78142ad2

  • SHA512

    f7058d1f32fc976705f8c4abf9242343119a44a32ec8969a133366e3c6f0af77e853db6de306e1b6f8c78e5d5efd7e566f4e340f8a616e3ec01aa7eb35f60664

  • SSDEEP

    98304:DhDq6qXCP7yKPNmxecLushvf7U9BYnK/Ag12QzwZ+8/jN3zz+ESjsEtZ3TW6:dDq6UE7oJQzw/jNDzm53Th

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b78112b8eced8b7e581730c13e55dd7e9a722acbe6c68f806883913d78142ad2.exe
    "C:\Users\Admin\AppData\Local\Temp\b78112b8eced8b7e581730c13e55dd7e9a722acbe6c68f806883913d78142ad2.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\gasdgtt\TD远程协助(TO DESK) 2.3.0\install\TD远程协助(TO DESK).msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\b78112b8eced8b7e581730c13e55dd7e9a722acbe6c68f806883913d78142ad2.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1717908529 "
      2⤵
      • Enumerates connected drives
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      PID:2668
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D0039FE920748E15D9C3CE3324C285DC C
      2⤵
      • Loads dropped DLL
      PID:2420
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 5753C9A843005F71CF85A78129A4A5A4 C
      2⤵
      • Loads dropped DLL
      PID:2468

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\gasdgtt\TD远程协助(TO DESK) 2.3.0\install\TD远程协助(TO DESK).msi

          Filesize

          1.4MB

          MD5

          0392f8459009c52b349f798b30f39278

          SHA1

          7f46a00dbf265fe0b591a9dd7cd7f1165009e4a2

          SHA256

          410089e31e683cb8d4ed15e573c8547248777bd642ef7beb90713ba485850037

          SHA512

          2a8885e031fdd4aabcfb3c1dca04c0db0fe1fd8ea74cedd7e1c44a7d787a7947028dacebada243cc0455eab835cf012ee907c72323c74acbf31c500bc8e4e6da

        • \Users\Admin\AppData\Local\Temp\MSI60E5.tmp

          Filesize

          436KB

          MD5

          475d20c0ea477a35660e3f67ecf0a1df

          SHA1

          67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

          SHA256

          426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

          SHA512

          99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

        • memory/2344-0-0x0000000000300000-0x0000000000301000-memory.dmp

          Filesize

          4KB

        • memory/2344-30-0x0000000000300000-0x0000000000301000-memory.dmp

          Filesize

          4KB