Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 18:42

General

  • Target

    baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe

  • Size

    1007KB

  • MD5

    b6b4b30b82e3cc4d31844b73d89ad496

  • SHA1

    d295439b929266922024307c4503c3a824851ea2

  • SHA256

    baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9

  • SHA512

    b56e6cd35f5f6c3271bc89b0f9649157cf704279b616e85ad85827175dc5936f669e5217dc4b4a41360c12fbe7940757e8a320e4b97ec65f529233e67a353943

  • SSDEEP

    12288:K7+PZK9I7MNmnx6Fg7kbiKFtC+eHNXXuz8sxKp7hIxLBy8omtm0/jG8Dqc:K7SiL28btC+co3LBy8omo07G8Dqc

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1152
      • C:\Users\Admin\AppData\Local\Temp\baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe
        "C:\Users\Admin\AppData\Local\Temp\baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3012
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$a1390.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2812
          • C:\Users\Admin\AppData\Local\Temp\baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe
            "C:\Users\Admin\AppData\Local\Temp\baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe"
            4⤵
            • Executes dropped EXE
            PID:2676
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2080
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2660
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2756

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        251KB

        MD5

        412c84a84ee1f753aab61983dab81871

        SHA1

        3ff6d44a264e52f0bc0c644fe399ec99bf9ef013

        SHA256

        1cfea775593e7ce2c698a171a33c7e21fb545e2c67ba6c47777d8e461ac8f1c4

        SHA512

        3c52c6534a62bf11eedc332810e04d8854392f546f33736cc88fdaaf9fba0744269bbfd4e75545c0b50f6d0556bb3b855df407bc54e6c5a54f4cbbe5f9b07dd9

      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

        Filesize

        471KB

        MD5

        99ea9b604a7a734d3087fa6159684c42

        SHA1

        709fa1068ad4d560fe03e05b68056f1b0bedbfc8

        SHA256

        3f733f9e6fec7c4165ca8ba41eb23f604a248babe794c4ad2c6c3ce8032aab1c

        SHA512

        7af8008c7e187f925c62efc97e1891a7a38d089302dba39fbde137fb895e0592847ed0982c824c2075be8e6b95b6ce165ecb848ab85adf53779ebef613410fbb

      • C:\Users\Admin\AppData\Local\Temp\$$a1390.bat

        Filesize

        722B

        MD5

        164471303740d63fb439151d662d3b12

        SHA1

        a0b53746bc5de13c907a7bc02954737673797b5b

        SHA256

        01da07db47e31cb7f06ea6dc9b5d958823de11e5a2d089b08ed1e0541d66463f

        SHA512

        d3ebab2fe586736dcee709f3bb0694b8d73f9d27e3bedf026ce22a1c86f3f623db12737f011769ec3e4c69d87e094be63ea90e7b13a36a6f3976462887686cc9

      • C:\Users\Admin\AppData\Local\Temp\baae1b5d1e75efbde5bbc7312d95d9bd1b62dc85f65ffed6333307d07240cee9.exe.exe

        Filesize

        981KB

        MD5

        7f3528cd8c220c32eb5453c2e50c2435

        SHA1

        e7434bb57eec4bbfcb6375ee8c33d5d0a8a1d4e5

        SHA256

        e83b0a57520815815e5e2e1fb8014f5d340369a2252a1ff97ab67d099c9a4315

        SHA512

        b73aee0b78051f1b16535282bec757ce516d3a25d9af67cd358100663f352a9a571a6413846a46b96f3ac5b3137bfac418941c79e87ff7b58d41cdaa73051d6f

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        f0eb54d6d17689ab4e229ce122317bbc

        SHA1

        93a5a82c43c6d4089ccccfc434985a9c3baa1dc4

        SHA256

        80da141e0ba00151479dedc491ae3a1d967e9e30f06b29a4eda22d6fd1ba03b6

        SHA512

        cd5c2bc37516daa390924b54f1108551437988303c4ce7aa33c2bb44418e78a7d68d129fa6769a3eae9fb7aa5281730e8282ab75c06a5cb63cc211f88a213f37

      • F:\$RECYCLE.BIN\S-1-5-21-481678230-3773327859-3495911762-1000\_desktop.ini

        Filesize

        9B

        MD5

        4f2460b507685f7d7bfe6393f335f1c9

        SHA1

        378d42f114b1515872e58de6662373af31ab8c7b

        SHA256

        47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42

        SHA512

        75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb

      • memory/1152-30-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

        Filesize

        4KB

      • memory/2080-477-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2080-34-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2080-41-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2080-48-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2080-94-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2080-100-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2080-1877-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2080-3337-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3012-17-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3012-42-0x00000000020F0000-0x0000000002124000-memory.dmp

        Filesize

        208KB

      • memory/3012-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3012-18-0x00000000020F0000-0x0000000002124000-memory.dmp

        Filesize

        208KB

      • memory/3012-12-0x00000000020F0000-0x0000000002124000-memory.dmp

        Filesize

        208KB