Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 17:36

General

  • Target

    c68b0aafb3aa63494c48a941cff07fe11d58370f2e2c1915fd2cb23f3658bd34.exe

  • Size

    1.2MB

  • MD5

    e64216cb5d54d2e626b33052517dcc2a

  • SHA1

    a68915744162197ffd42cdc373944b6b4cb739aa

  • SHA256

    c68b0aafb3aa63494c48a941cff07fe11d58370f2e2c1915fd2cb23f3658bd34

  • SHA512

    4730d03a44d9ebd6e45a7604cbb3e9464883ffe0171e425311e2990fcc2081c003d5be86d9edab46548a0f38839de360ae6e024e9f35b7d28f23c97c56149c49

  • SSDEEP

    24576:x7gaWLpaiGhP1x+96UBz1ViIhTj4OHAeTkuppyLELJt/8Vh2zcxZ7W9c1SoNN0y7:x7gajiI1k9/H9SOHAmkVLk8H2GpXSyx

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3268
      • C:\Users\Admin\AppData\Local\Temp\c68b0aafb3aa63494c48a941cff07fe11d58370f2e2c1915fd2cb23f3658bd34.exe
        "C:\Users\Admin\AppData\Local\Temp\c68b0aafb3aa63494c48a941cff07fe11d58370f2e2c1915fd2cb23f3658bd34.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3352
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF71.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2992
          • C:\Users\Admin\AppData\Local\Temp\c68b0aafb3aa63494c48a941cff07fe11d58370f2e2c1915fd2cb23f3658bd34.exe
            "C:\Users\Admin\AppData\Local\Temp\c68b0aafb3aa63494c48a941cff07fe11d58370f2e2c1915fd2cb23f3658bd34.exe"
            4⤵
            • Executes dropped EXE
            PID:1692
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4480
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2180
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2216
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4244 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:4376

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

          Filesize

          251KB

          MD5

          cafcc9d7c72ff567e107a878c793cf0e

          SHA1

          07d0589ee9faf37b77b47695f316d317baf81246

          SHA256

          e850f4e1eff89030de3b4e1c529770ec3d102547699f5687699cc10042bca715

          SHA512

          fe341d07fbe64548e5050c3294392848eaf28d975c7bf2ce41d57511d2bb45da05f6f53ae4c4871163f2000c64a721475a77daa5458f4c7de35d637654c7dd1b

        • C:\Program Files\7-Zip\7z.exe

          Filesize

          570KB

          MD5

          859572e823adf5ef7ff8ec5e740e7ce1

          SHA1

          c09b84ef6f87adc56949b6efb4cb76ec57cf13b7

          SHA256

          ef4902886e0e13f37c815cfbbfd13d3d8a6e891e0011fa1dce5cebcbc3a87df8

          SHA512

          05b66c66785bf27a27f201e1e0788e5476eae89cfc33c9f51d5f4d73bd106d4c9c8ef7da6261e8449cedf7a100e4665dfad3d202cfd104fbf567d80adbbcd9af

        • C:\Users\Admin\AppData\Local\Temp\$$aEF71.bat

          Filesize

          722B

          MD5

          7b2095935b73831a334a9ef13e181089

          SHA1

          9c8cec5b0bcd3d4eac64e63118288d34607bea85

          SHA256

          15da5fccb36165a6d38aac5773a03db61a75ea82f1222c6471669b20940941e3

          SHA512

          e8fbb9027657989d78680e6de8ebd3a55387e80fd1c7ba4886627e43d6c16422f79670fe238639bfe7d6267d126b8acd87a0e4968d68ae7e6b8b9c18d72bc8fb

        • C:\Users\Admin\AppData\Local\Temp\c68b0aafb3aa63494c48a941cff07fe11d58370f2e2c1915fd2cb23f3658bd34.exe.exe

          Filesize

          1.1MB

          MD5

          fabe184f6721e640474e1497c69ffc98

          SHA1

          2f23a6389470db5d0dd2095d64939657d8d3ea9d

          SHA256

          759aa04d5b03ebeee13ba01df554e8c962ca339c74f56627c8bed6984bb7ef80

          SHA512

          2924fd60f5dd636f643b68d402b65c2bfab5536122aa688ebba5ae142c7d04ce8b1c8e078f54db8adadce9d5c6fa74c0794604ecc16a4c5489f9ca70a6d9e1c4

        • C:\Windows\Logo1_.exe

          Filesize

          26KB

          MD5

          8ba3b10246e04d4b57287e690f77057b

          SHA1

          356eb7a62df1fdfb78711f5bb7d1347df5bbe797

          SHA256

          1c8c64333fcd85341531abb72c7673109683f519ae0e7fc228e51d9a082708cc

          SHA512

          eb79e2861d0ebc95ca0b9db177770ebaf5ea528f98efb018a7bc57c576cff11f4a71bc047c047b3ee04314b821b8481f59bfb36d3449838ee2579d51f0e9bcf5

        • F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\_desktop.ini

          Filesize

          9B

          MD5

          4f2460b507685f7d7bfe6393f335f1c9

          SHA1

          378d42f114b1515872e58de6662373af31ab8c7b

          SHA256

          47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42

          SHA512

          75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb

        • memory/3352-11-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/3352-0-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/4480-33-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/4480-27-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/4480-38-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/4480-43-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/4480-8-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/4480-143-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/4480-1182-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/4480-2139-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/4480-20-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/4480-4911-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB