Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 18:36

General

  • Target

    008b793d4b4945905e33ad61bb178d0ae07141517ea104831cc74181b666ed56.exe

  • Size

    142KB

  • MD5

    b2bfd79e5910e1f7bf1874b2b7c017aa

  • SHA1

    ac6f97a6e24a2dc69496e7e7e3ec4e25a6d89c09

  • SHA256

    008b793d4b4945905e33ad61bb178d0ae07141517ea104831cc74181b666ed56

  • SHA512

    cd2ce937be65018de660ffc8026dc67e9c8dccdbb240773de46fd49e137d6731cb8f5744435f05f571552cdbef085489dde7f377f38d0b3d782f7ec4fd8b98ff

  • SSDEEP

    3072:hftffhJCuU7PQtDzrFJxMpakpk13nJKMpakpA8J+MpakpF13xJi1NAMpakp613mJ:pVfhgu1DnFJxJZ13nJKJf8J+Js13xJiq

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3420
      • C:\Users\Admin\AppData\Local\Temp\008b793d4b4945905e33ad61bb178d0ae07141517ea104831cc74181b666ed56.exe
        "C:\Users\Admin\AppData\Local\Temp\008b793d4b4945905e33ad61bb178d0ae07141517ea104831cc74181b666ed56.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4616
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE697.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2968
          • C:\Users\Admin\AppData\Local\Temp\008b793d4b4945905e33ad61bb178d0ae07141517ea104831cc74181b666ed56.exe
            "C:\Users\Admin\AppData\Local\Temp\008b793d4b4945905e33ad61bb178d0ae07141517ea104831cc74181b666ed56.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2488
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:440
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:752
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2324
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3960,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:8
        1⤵
          PID:5056

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

          Filesize

          251KB

          MD5

          8127727596399cf19c53447f179b38bc

          SHA1

          c58115bd548eb653598b2509554646794a98f396

          SHA256

          b39519f128db77ff20cbbbfee07e54cab923592a46e9e75d45f40a8312135580

          SHA512

          a88d06e6e11e9b3a107199ddad875062995383bbeae90b487077630041b358bbfe8464af69ef4fd205980fd6769fa84ae7b496aa0df4226f795a9d639f08e9bc

        • C:\Program Files\7-Zip\7z.exe

          Filesize

          570KB

          MD5

          4e7100f1e12d0db9a7f734f8aeb8028b

          SHA1

          fd89a577f9c712575552427989c8bde36e183d6c

          SHA256

          12170265e750d261bc60c321d076c7fb1c03491cb5a3743e62c85e55a3b8be75

          SHA512

          f7b93b9aaaa47e4da25f9c9cc10aa3b186b533a327d22a7b0525c938426a11c289af7d9e5a28fb1abb41f159c5f3533aaa5499271fd3934e4d14f39f2dd50c71

        • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

          Filesize

          636KB

          MD5

          d82ffc872aed7c85cf936dcdcc2e6372

          SHA1

          50ca56cb4a429ce1532afaa2732f61833fc2b54f

          SHA256

          a487733710d946abff1a93a23ae6bbafd6c0800bc78e4d5e3cac36e2a14ddace

          SHA512

          0b0031418275c6be01f7757111058cd5bd3e5f4862e0631e2e28c5e7ffbb271446abdc2a88a7953ae55112799bc4a051becc2b14491e0d1760e336498665cc8b

        • C:\Users\Admin\AppData\Local\Temp\$$aE697.bat

          Filesize

          722B

          MD5

          7568959f0440788ba38afa43c94da155

          SHA1

          b37e6839433e946cc6730667fda489177668ee61

          SHA256

          fab9b1babbfdbb2c88400150bdb39c09d4f447c255715897986df4d9d6093e26

          SHA512

          5a0ea1be37171d0e134b3cc8d0904fa350f5f391ffbc8dad2fc084e222733f432137b9a1568eb5aba3b90f75c50390ab74997c941a264e7738d1859591ab3117

        • C:\Users\Admin\AppData\Local\Temp\008b793d4b4945905e33ad61bb178d0ae07141517ea104831cc74181b666ed56.exe.exe

          Filesize

          116KB

          MD5

          0c17c996f9ef8fdcb768f9aa1fbb85a5

          SHA1

          da090853e2cef892bbec3a24c560facd7e94c798

          SHA256

          dc82f3aa6a62edeeb6fc519f83fe9ac7ea645176576ac42f0c04753d7d342418

          SHA512

          a87238e80292ee6a81b0cecd6ff3bce1bbca944890de2171730d54513e1ae28fc0375e4a1a993d3ce8e8565fa7d35e716b6800a3ed06e7bb7c3bfefe963fc962

        • C:\Windows\Logo1_.exe

          Filesize

          26KB

          MD5

          f4e54f43ef0126564e829fa90765bed8

          SHA1

          7cf265bec52cd543eae7b87b6fa4aa3409226f33

          SHA256

          4f8b78bfed5a47f51ab5eb9a8e43196e504e6cdfe9660cd75cd5607f2dcf9fa5

          SHA512

          3ddb20d41a801f8b39d5f43a01055f0d9d6a5aa7094c0762aa32b76d74bdc90dd9ffa3a459056788fc3370b0f1964495936711ba25b7e838eef1cbdead2435d8

        • F:\$RECYCLE.BIN\S-1-5-21-1181767204-2009306918-3718769404-1000\_desktop.ini

          Filesize

          9B

          MD5

          4f2460b507685f7d7bfe6393f335f1c9

          SHA1

          378d42f114b1515872e58de6662373af31ab8c7b

          SHA256

          47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42

          SHA512

          75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb

        • memory/440-29-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/440-35-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/440-39-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/440-22-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/440-1239-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/440-11-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/440-4877-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/440-5322-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/4616-0-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/4616-9-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB