Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 04:52

General

  • Target

    b78112b8eced8b7e581730c13e55dd7e9a722acbe6c68f806883913d78142ad2.exe

  • Size

    6.0MB

  • MD5

    366bc6388245a3ae5a13a2bee4cd1b56

  • SHA1

    5ca5f8df4eb6a23f8a8c4909e314467cf38deb36

  • SHA256

    b78112b8eced8b7e581730c13e55dd7e9a722acbe6c68f806883913d78142ad2

  • SHA512

    f7058d1f32fc976705f8c4abf9242343119a44a32ec8969a133366e3c6f0af77e853db6de306e1b6f8c78e5d5efd7e566f4e340f8a616e3ec01aa7eb35f60664

  • SSDEEP

    98304:DhDq6qXCP7yKPNmxecLushvf7U9BYnK/Ag12QzwZ+8/jN3zz+ESjsEtZ3TW6:dDq6UE7oJQzw/jNDzm53Th

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 6 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b78112b8eced8b7e581730c13e55dd7e9a722acbe6c68f806883913d78142ad2.exe
    "C:\Users\Admin\AppData\Local\Temp\b78112b8eced8b7e581730c13e55dd7e9a722acbe6c68f806883913d78142ad2.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4752
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\gasdgtt\TD远程协助(TO DESK) 2.3.0\install\TD远程协助(TO DESK).msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\b78112b8eced8b7e581730c13e55dd7e9a722acbe6c68f806883913d78142ad2.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1717927297 "
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      PID:1096
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 76A785407364165C3BE935ED0A83F72D C
      2⤵
      • Loads dropped DLL
      PID:884
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B5ABEA5F4B845CB7EF2C7701FA3F8E27 C
      2⤵
      • Loads dropped DLL
      PID:4628
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4332

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\MSI20B3.tmp

            Filesize

            436KB

            MD5

            475d20c0ea477a35660e3f67ecf0a1df

            SHA1

            67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

            SHA256

            426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

            SHA512

            99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

          • C:\Users\Admin\AppData\Roaming\gasdgtt\TD远程协助(TO DESK) 2.3.0\install\TD远程协助(TO DESK).msi

            Filesize

            1.4MB

            MD5

            0392f8459009c52b349f798b30f39278

            SHA1

            7f46a00dbf265fe0b591a9dd7cd7f1165009e4a2

            SHA256

            410089e31e683cb8d4ed15e573c8547248777bd642ef7beb90713ba485850037

            SHA512

            2a8885e031fdd4aabcfb3c1dca04c0db0fe1fd8ea74cedd7e1c44a7d787a7947028dacebada243cc0455eab835cf012ee907c72323c74acbf31c500bc8e4e6da