Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 18:46

General

  • Target

    05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c.exe

  • Size

    37KB

  • MD5

    d0547354634061d7a51e060809976e46

  • SHA1

    3747abeae329ebb5bbd2054ca8e1ca7dbabc7d4c

  • SHA256

    05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c

  • SHA512

    12989541384b37352d1e412f2e8257c1a59cf92a76615f59855c80f4b580cbb4e7998c97735f891a15f9dc8f5d39b7a08bb8c93a670ac15147a749d2ec5df5a0

  • SSDEEP

    384:JC+EaVVpDSL/7wIUAch1A9NB/erdO9oMCCQcxbRxla0rh84KtI3/w9netgKzU7/P:JSfL/76As1FdMQ8RjaeeILtQhRSSDSIz

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c.exe
    "C:\Users\Admin\AppData\Local\Temp\05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Users\Admin\AppData\Local\Temp\opera_autoupdater.exe
      "C:\Users\Admin\AppData\Local\Temp\opera_autoupdater.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      PID:2152

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    eacfae02e54c8d718898c199ac8f3388

    SHA1

    4ed2451227f6b54c7bb0cc58fe75cfb161bf9c18

    SHA256

    924ef80cac4ed993a7e76897f9c1a864e22989fd7ca2a16317e5743f684a07c4

    SHA512

    b0f431e98ce6ecb1b0bf66284042e6699e783f74f9f6a77c0b5bb63f6360b3dcdc0df5be33ac9cce97ad547a3debae13fc3a9a021bf1da36ddea35b65c05a544

  • C:\Users\Admin\AppData\Local\Temp\Cab7C72.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar7D5F.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\Temp\opera_autoupdater.exe

    Filesize

    38KB

    MD5

    47ae4aa285603bc6ec800348cba7fc62

    SHA1

    483ede8229090eae61d276d8e584de8f40777efe

    SHA256

    1293cafefb327e01e0ba785c16c293ef022736095e79e32908cfac34e5e22e01

    SHA512

    fd5558d2349fff5d1a3e06ef98a08abcd797dcbb9c3fbd65216fe0ecae7082ec39da7dd56e87fab649928267f8081b3333cade09ceeba34af207dd8d14f0cb13

  • memory/3000-0-0x0000000000402000-0x0000000000403000-memory.dmp

    Filesize

    4KB