Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    12/06/2024, 04:52

General

  • Target

    d7db88115f40eeb5b08be7faa8e414589dd8d5c4569e21765cd260fec0ff031f.exe

  • Size

    12KB

  • MD5

    1009ec37a87bcbd283ac22c19fd9e8ef

  • SHA1

    d86fc9cfb640b898e0fee1d36d04d7e532c697e6

  • SHA256

    d7db88115f40eeb5b08be7faa8e414589dd8d5c4569e21765cd260fec0ff031f

  • SHA512

    b1847bb0b0c7ebe52b296c6b9a653f8bc7385386a71b376251c00f07bd7a0dc78b20f192ac2655636c1eb13783c9a631b6c8c8688b51fe5737129e4272e8a530

  • SSDEEP

    384:9L7li/2zHq2DcEQvdQcJKLTp/NK9xayH:tbMCQ9cyH

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7db88115f40eeb5b08be7faa8e414589dd8d5c4569e21765cd260fec0ff031f.exe
    "C:\Users\Admin\AppData\Local\Temp\d7db88115f40eeb5b08be7faa8e414589dd8d5c4569e21765cd260fec0ff031f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hrynlkwn\hrynlkwn.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES602A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB120CB7635EC4D5C89973B5541962F54.TMP"
        3⤵
          PID:2696
      • C:\Users\Admin\AppData\Local\Temp\tmp5B2B.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp5B2B.tmp.exe" C:\Users\Admin\AppData\Local\Temp\d7db88115f40eeb5b08be7faa8e414589dd8d5c4569e21765cd260fec0ff031f.exe
        2⤵
        • Deletes itself
        • Executes dropped EXE
        PID:2748

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\RE.resources

            Filesize

            2KB

            MD5

            0da6623e576193254e58434a9edd0c6e

            SHA1

            b5dbdde35bb55f3eaaa16b23f9674e8119772212

            SHA256

            ee3e0e4c400bc1c6a4d5aae76e6d44b7b5ede8751d9a5d6203d3580bf3c374e3

            SHA512

            7cf4c77bb35583ca52c33a528a2e04da2956832577436bb99fb676f81dbc3e8bcd2dcdce2ee1874c569d407b82ec6a72f1e5b6c5ad17b4c37a50433726f9b778

          • C:\Users\Admin\AppData\Local\Temp\RES602A.tmp

            Filesize

            1KB

            MD5

            06d676cd3eb7e368c9eb55ac9d3358de

            SHA1

            dc85c26dc54eda1c3776295c376e9691828a0da3

            SHA256

            29afeb1f91e2890411c27fc256650e4eb094c6744585dd0f37cf5edace2327bc

            SHA512

            5f4a6c57f80d24e6c1731065df1e0edac479e4193f2e8b5cb7f81f79df5c9127aa1c3291a4016b37614c688727f454507ee99c2fa64d918b1b0f618307d1d96d

          • C:\Users\Admin\AppData\Local\Temp\hrynlkwn\hrynlkwn.0.vb

            Filesize

            2KB

            MD5

            feea7bf0777d825ff6f463417ffe3118

            SHA1

            13b416c2bcaf75f47a53bdd01ef2b5bed716536c

            SHA256

            349ed88a0cfdd7c5274f43c931c87c5cf6ed9fc9c032d660435155361ffebd5e

            SHA512

            420f2676b52c2a331ebc9f2fc3a761a0429f421970646e8c968cc9b94fc1558d4bf614f42278a317826fdc78b51647ce3b430e135879b5ee2da471831d46d5e4

          • C:\Users\Admin\AppData\Local\Temp\hrynlkwn\hrynlkwn.cmdline

            Filesize

            273B

            MD5

            13d35e9ade9d862d4d21edd49edf3078

            SHA1

            1e133fa74c7ac6828315636f3682713bcf266955

            SHA256

            6c3a434c9e7e6a5f4434143f893ac8e04c2aaa41dc9c78de82f59eb3ab7793d0

            SHA512

            b66b57bd8717cd8550d53086e5a084d00fad5044258bb74b2ba7390e0d708e72e237903f3d2f63978afc94cada8980727a40dc07d21ed22c2955594f1c5a9a70

          • C:\Users\Admin\AppData\Local\Temp\tmp5B2B.tmp.exe

            Filesize

            12KB

            MD5

            f9b4b2d0bfad861d0a4ea05e930df915

            SHA1

            7dc0eb00cfe9de5ef3507a2ec06e38ac6b797707

            SHA256

            8c912c57e359da0db3bae8d0a8c0622c59e82257a38debbd3d396bbc096aa375

            SHA512

            afedf5d1975e305c31d492cdd86713e3c2fdefbd983499e2d456cff71d8fab7ea97a0b5c875dd27c963c8ee97decd7abb0442d08e7be93ac4f2960ea054fd8e7

          • C:\Users\Admin\AppData\Local\Temp\vbcB120CB7635EC4D5C89973B5541962F54.TMP

            Filesize

            1KB

            MD5

            d3c56b0d548fb886ea051fccb58b701a

            SHA1

            b3a981aecd3e7fce0189c96b46e0956eb9da462f

            SHA256

            ab27c4577c33f819a2a0461c6f702ec508f36d39b1f5376ae39e0a4fe6c18f5a

            SHA512

            8d7dd939e45f8db15095ebb27c747f244e630e26e86a2c04792ac15e5e4710fbeba8a82ea1bacdb35ba95c01593ed1db9452bac47116e4318974cb25c848d72c

          • memory/2104-0-0x0000000074E8E000-0x0000000074E8F000-memory.dmp

            Filesize

            4KB

          • memory/2104-1-0x0000000001380000-0x000000000138A000-memory.dmp

            Filesize

            40KB

          • memory/2104-7-0x0000000074E80000-0x000000007556E000-memory.dmp

            Filesize

            6.9MB

          • memory/2104-24-0x0000000074E80000-0x000000007556E000-memory.dmp

            Filesize

            6.9MB

          • memory/2748-23-0x0000000000F70000-0x0000000000F7A000-memory.dmp

            Filesize

            40KB