Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 18:49

General

  • Target

    4928dedaf44a46abd5e014e2ad3ddf7e281a4ecd2cf6a00cb762679da9901afc.exe

  • Size

    29KB

  • MD5

    f0701d493c575432a1fc5e5fe6b323f7

  • SHA1

    b17d93ef21a614224ea906ddf17ccd565433f3d3

  • SHA256

    4928dedaf44a46abd5e014e2ad3ddf7e281a4ecd2cf6a00cb762679da9901afc

  • SHA512

    b9cf21304e0a86ccf411b7c62fea57780f7be83d77993b71d8dd9ecf7c17ac075c87b01f36286b82a94953012c78da5d2298bd6a210bbba45342b2988933d3e7

  • SSDEEP

    384:NbbtQY8N4g1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pBsT16GVRu1yK9fMnJG2V9dHS8

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1264
      • C:\Users\Admin\AppData\Local\Temp\4928dedaf44a46abd5e014e2ad3ddf7e281a4ecd2cf6a00cb762679da9901afc.exe
        "C:\Users\Admin\AppData\Local\Temp\4928dedaf44a46abd5e014e2ad3ddf7e281a4ecd2cf6a00cb762679da9901afc.exe"
        2⤵
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2344
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2432
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:2900

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        254KB

        MD5

        1cc007ad1cf7a7166c5948204c910c52

        SHA1

        378f62d6d34f7ce4ca389bd378ff9bce27222731

        SHA256

        302563b3bc71e1ec5178f58aceed32cf6c91664372d00f61038880b31b6bbecb

        SHA512

        9f6de25ba108d143d391b876658997c7f31989ca57f0d2783d45a23c721996c7c76cbd1f89c98feed38d55b5d11c1098898549872671164a688bef4e934fd463

      • C:\Program Files\7-Zip\7zFM.exe

        Filesize

        959KB

        MD5

        f0572dc5e55a0134164be82897b865f0

        SHA1

        3185a9c1f2d8f02386c3e0ae754d517393952731

        SHA256

        bc5bf78b30919044d13ae23ef35a4aa19a8fe498464db155a9c81ec3875f4c5f

        SHA512

        7e29723e8ba4b268cfd783f4b33b4905479dd7ff23efdc2668857f379d4815b44a59a451dd65ffc32e59c52f5a583d4ef763d8b7970aa85757f3873638e9e95f

      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

        Filesize

        474KB

        MD5

        c14a5111b798cff20d7d66b0e035d409

        SHA1

        29f0894552b30815fed6ad231b5721e876869552

        SHA256

        fd6f57dc1b82f6301cbecbf9db5728a9a69b10e3edbf4f8a1dfef571c77a6cb6

        SHA512

        a4d8b74216c76fa3d48ab7300452725602bc6d5bcc0e6c23d458d65362cd24751f23755180ae69633090b172e95f18f225c0cb4a71dd1e050d8b3dff466e7f1b

      • F:\$RECYCLE.BIN\S-1-5-21-2812790648-3157963462-487717889-1000\_desktop.ini

        Filesize

        9B

        MD5

        4f2460b507685f7d7bfe6393f335f1c9

        SHA1

        378d42f114b1515872e58de6662373af31ab8c7b

        SHA256

        47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42

        SHA512

        75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb

      • memory/1264-5-0x0000000002530000-0x0000000002531000-memory.dmp

        Filesize

        4KB

      • memory/2344-66-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2344-0-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2344-72-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2344-20-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2344-564-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2344-1849-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2344-2207-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2344-14-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2344-3309-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2344-7-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB