Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 18:36

General

  • Target

    008b793d4b4945905e33ad61bb178d0ae07141517ea104831cc74181b666ed56.exe

  • Size

    142KB

  • MD5

    b2bfd79e5910e1f7bf1874b2b7c017aa

  • SHA1

    ac6f97a6e24a2dc69496e7e7e3ec4e25a6d89c09

  • SHA256

    008b793d4b4945905e33ad61bb178d0ae07141517ea104831cc74181b666ed56

  • SHA512

    cd2ce937be65018de660ffc8026dc67e9c8dccdbb240773de46fd49e137d6731cb8f5744435f05f571552cdbef085489dde7f377f38d0b3d782f7ec4fd8b98ff

  • SSDEEP

    3072:hftffhJCuU7PQtDzrFJxMpakpk13nJKMpakpA8J+MpakpF13xJi1NAMpakp613mJ:pVfhgu1DnFJxJZ13nJKJf8J+Js13xJiq

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1204
      • C:\Users\Admin\AppData\Local\Temp\008b793d4b4945905e33ad61bb178d0ae07141517ea104831cc74181b666ed56.exe
        "C:\Users\Admin\AppData\Local\Temp\008b793d4b4945905e33ad61bb178d0ae07141517ea104831cc74181b666ed56.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3016
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$a24A0.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2340
          • C:\Users\Admin\AppData\Local\Temp\008b793d4b4945905e33ad61bb178d0ae07141517ea104831cc74181b666ed56.exe
            "C:\Users\Admin\AppData\Local\Temp\008b793d4b4945905e33ad61bb178d0ae07141517ea104831cc74181b666ed56.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2868
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2224
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2144
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2292

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        251KB

        MD5

        8127727596399cf19c53447f179b38bc

        SHA1

        c58115bd548eb653598b2509554646794a98f396

        SHA256

        b39519f128db77ff20cbbbfee07e54cab923592a46e9e75d45f40a8312135580

        SHA512

        a88d06e6e11e9b3a107199ddad875062995383bbeae90b487077630041b358bbfe8464af69ef4fd205980fd6769fa84ae7b496aa0df4226f795a9d639f08e9bc

      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

        Filesize

        471KB

        MD5

        f9fc019eacb573ec828d2d9ff6a48318

        SHA1

        b91958dc8d178b6eeb35e829bab84d0fb12c2280

        SHA256

        bf9ba3df2bad76d15f4efe42c0c59f37b9454907958892df8ab996552658934e

        SHA512

        998ba7bc7cdd5df3e1acfda6f4f92ec9d27732e1e182177dff310f3c918f3be99626a3526bebdff5bb7eb980640434baf56e0f08bfd125168c0a9e37e7239305

      • C:\Users\Admin\AppData\Local\Temp\$$a24A0.bat

        Filesize

        722B

        MD5

        848edb8a77bfb5093e0543b5f2cfaa61

        SHA1

        4fd5f1fad631e0a8e807924e685443b8e0e8b40b

        SHA256

        ad16e02c0126fa58e926d3d4d94c46886462f0d7874aedf5e7c3b583ecaf1575

        SHA512

        b55ffcecafc6f1605aeda2d1ed77f07c952274e44e64c45d3430488fdbd49a2ccea93bf910d4d0ff26004d5af3b81d47b31ad5fbe55a2487689f2efe0195c5a9

      • C:\Users\Admin\AppData\Local\Temp\008b793d4b4945905e33ad61bb178d0ae07141517ea104831cc74181b666ed56.exe.exe

        Filesize

        116KB

        MD5

        0c17c996f9ef8fdcb768f9aa1fbb85a5

        SHA1

        da090853e2cef892bbec3a24c560facd7e94c798

        SHA256

        dc82f3aa6a62edeeb6fc519f83fe9ac7ea645176576ac42f0c04753d7d342418

        SHA512

        a87238e80292ee6a81b0cecd6ff3bce1bbca944890de2171730d54513e1ae28fc0375e4a1a993d3ce8e8565fa7d35e716b6800a3ed06e7bb7c3bfefe963fc962

      • C:\Windows\rundl132.exe

        Filesize

        26KB

        MD5

        f4e54f43ef0126564e829fa90765bed8

        SHA1

        7cf265bec52cd543eae7b87b6fa4aa3409226f33

        SHA256

        4f8b78bfed5a47f51ab5eb9a8e43196e504e6cdfe9660cd75cd5607f2dcf9fa5

        SHA512

        3ddb20d41a801f8b39d5f43a01055f0d9d6a5aa7094c0762aa32b76d74bdc90dd9ffa3a459056788fc3370b0f1964495936711ba25b7e838eef1cbdead2435d8

      • F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\_desktop.ini

        Filesize

        9B

        MD5

        4f2460b507685f7d7bfe6393f335f1c9

        SHA1

        378d42f114b1515872e58de6662373af31ab8c7b

        SHA256

        47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42

        SHA512

        75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb

      • memory/1204-32-0x0000000002D60000-0x0000000002D61000-memory.dmp

        Filesize

        4KB

      • memory/2224-101-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2224-36-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2224-43-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2224-49-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2224-95-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2224-513-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2224-1854-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2224-2022-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2224-3314-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2224-21-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3016-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3016-16-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB