Analysis

  • max time kernel
    154s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 18:36

General

  • Target

    9e2c235f77468ae3906a9c5cbe3ec043732e485492144e7636dbdd091e58b1be.exe

  • Size

    694KB

  • MD5

    54fe70bf380d8e2fa31ce15b0dc15bf4

  • SHA1

    f8d5f8c6096273233a1b19ffd96fa6c321d7ac30

  • SHA256

    9e2c235f77468ae3906a9c5cbe3ec043732e485492144e7636dbdd091e58b1be

  • SHA512

    49c034b64bfd0c0714fc79d2dd3b8ad115756fc2872ff7d3a826d04da4e81c362152737aaba5ba41e36c3f3034731c0525366d9438cf0dc089b3a1e6b3e8459c

  • SSDEEP

    12288:A7+fNcKAEJ6RLtx4c8PF39A55nJTuxGfqseVF+J92QpCgGy9RTPq6xy3NhYhYUnX:A7iNcKAEJ6Rpx4c8PF39A55nJMGfqsem

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3372
      • C:\Users\Admin\AppData\Local\Temp\9e2c235f77468ae3906a9c5cbe3ec043732e485492144e7636dbdd091e58b1be.exe
        "C:\Users\Admin\AppData\Local\Temp\9e2c235f77468ae3906a9c5cbe3ec043732e485492144e7636dbdd091e58b1be.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2432
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1836.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:668
          • C:\Users\Admin\AppData\Local\Temp\9e2c235f77468ae3906a9c5cbe3ec043732e485492144e7636dbdd091e58b1be.exe
            "C:\Users\Admin\AppData\Local\Temp\9e2c235f77468ae3906a9c5cbe3ec043732e485492144e7636dbdd091e58b1be.exe"
            4⤵
            • Executes dropped EXE
            PID:3396
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5076
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3496
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:3000
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:3148

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

          Filesize

          251KB

          MD5

          baefd80d920c46144c270e5bc13ce8f9

          SHA1

          a9dfeeaea77073b1f031a94457e1b436795c2230

          SHA256

          908015e6f4700ed4fe9817143e5afc0d3bd6820692fabc15df0a7c480a6b4754

          SHA512

          e363bf05e54048637ca57c4d0ae7da4b8f061098a04a8d8a85d5fd24bc52757901db9c9c14bebd2f57e2e51e1d365bf10f4ef88acd1bc27e1ec4fc8004ebc25b

        • C:\Program Files\7-Zip\7z.exe

          Filesize

          570KB

          MD5

          f5285ac9d939519a5baee61dc332f4d0

          SHA1

          49b16d664d40e0a2ca0ed549bfdfe14de77c2845

          SHA256

          1e612247296072b71e66ea5afe9629e2ed56ed215d08086451bb416742f840fa

          SHA512

          cc642cf22504d1f4204fd3ca26f348e4f1fbeb5b122a1e442ecaebb4012e71388e7d68b749353d4146962bbbbb8e7a7cb650ae040949cc97fdcc4d03b6648934

        • C:\Users\Admin\AppData\Local\Temp\$$a1836.bat

          Filesize

          722B

          MD5

          4dc3ff8e48ea8e2c89b7947e1e8d5b0e

          SHA1

          ddf5559b00a8bff7adc42b9ce1319018dc352c59

          SHA256

          6b1095a9eb3f788e1d1b6e8aff58262b2e31584c7cf22d8305ccf0e83c0ddb0f

          SHA512

          ac0746afc7b14361bc9cf47ec4c76c1b95be40314f10decec7d97e6878359fbd2a2b69040cc4fad4e6c813b33cc00cc000c1b01c0784b639e6c3aa8abd422136

        • C:\Users\Admin\AppData\Local\Temp\9e2c235f77468ae3906a9c5cbe3ec043732e485492144e7636dbdd091e58b1be.exe.exe

          Filesize

          667KB

          MD5

          c904e884cc991c35da2f09423322c6a5

          SHA1

          65c1ed3c9177f8a1d61a6fc52b46361434e34187

          SHA256

          25673cd4933a85bc98db759d37a2aecdbf06aff2cd3045be8b3f7e0593d35366

          SHA512

          773408889e3d3c6ef7772509ac648d4ed9a2c24588041dc406910dddc66e69b8120244b7bd69af5d3ad7101010de9f60c8bf3071492ae89b75bc925d52870b52

        • C:\Windows\Logo1_.exe

          Filesize

          26KB

          MD5

          d49b1ebb885d8df62f516abeaf81eb8d

          SHA1

          b35b293a2b9aae438e3fe7a63c695d74767d2d5d

          SHA256

          9a9ebdf3d499ba4b221c15f154018f0fe6d5f97bfdd924d9a7b5aad9d1e39827

          SHA512

          2af67b0693f1215cedfab5f078d7e349ac282d32c5b4e3654e3feeb110ab410bc84d79ebba61f6314aae1c6cc69929a2a0177cdfea37dce9e4745289994c6d5c

        • F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\_desktop.ini

          Filesize

          9B

          MD5

          4f2460b507685f7d7bfe6393f335f1c9

          SHA1

          378d42f114b1515872e58de6662373af31ab8c7b

          SHA256

          47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42

          SHA512

          75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb

        • memory/2432-0-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2432-13-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/3396-21-0x0000000000400000-0x000000000047D000-memory.dmp

          Filesize

          500KB

        • memory/3396-18-0x0000000000400000-0x000000000047D000-memory.dmp

          Filesize

          500KB

        • memory/5076-20-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/5076-28-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/5076-36-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/5076-43-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/5076-51-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/5076-177-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/5076-1192-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/5076-1671-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/5076-8-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB