Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    14-06-2024 02:50

General

  • Target

    e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe

  • Size

    1.2MB

  • MD5

    ca8e6c01282b57405ae4b2af66adbafa

  • SHA1

    dab881b117a4e3515ff9315e30ce1a0a814ad42d

  • SHA256

    e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c

  • SHA512

    e8bffdcd21fa92b902b2b3b0e1dee8ce38b2c9956758acd217b1b89a085d435bac293a7d11cacd043855fcb999c8d302af42ad8d340af748834013c1875a6da4

  • SSDEEP

    24576:CAHnh+eWsN3skA4RV1Hom2KXMmHa7cldzvKO1X3JWCRYj3m25:Fh+ZkldoPK8Ya7yd+Od3BRUj

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:1168
    • C:\Users\Admin\AppData\Local\Temp\e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe
      "C:\Users\Admin\AppData\Local\Temp\e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:288
      • C:\Users\Admin\AppData\Local\directory\name.exe
        "C:\Users\Admin\AppData\Local\Temp\e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1664
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:2556
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\SysWOW64\rundll32.exe"
            5⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:2464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Graff

    Filesize

    28KB

    MD5

    2456358082381cfbd59c47ddaa58edec

    SHA1

    498b677a53f41f660f095ef549280dc23a43b680

    SHA256

    f9e93076b397c10d887645865170f0fb0a0dd4fcaae025d62563412430d82f93

    SHA512

    a3767b7c724e1b8abc3bc1e525eb89d6523205e96fb3e8c244cc6ef6cf2594d929860df25d2bb7277713be9a6846282c1527b68f81ac74c32acd4e5162e6a6df

  • C:\Users\Admin\AppData\Local\Temp\jinrikisha

    Filesize

    265KB

    MD5

    da0227fbe8330d1408a4d3faa465be0a

    SHA1

    ee14a891e166d16850b4883311ee05584735165a

    SHA256

    5a388efe7461b3845cbd5f9ff89f97937fbdf08edf226646d27421d393ee9825

    SHA512

    365240a84c7935bf4021d494261a0a7511a1f5da98a54a5eabad77f3ce06c3a8bd8d3bf43c10ae90a53f1cf1604d2cfcb6892da3443187e0af02eb86d968bf01

  • \Users\Admin\AppData\Local\directory\name.exe

    Filesize

    1.2MB

    MD5

    ca8e6c01282b57405ae4b2af66adbafa

    SHA1

    dab881b117a4e3515ff9315e30ce1a0a814ad42d

    SHA256

    e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c

    SHA512

    e8bffdcd21fa92b902b2b3b0e1dee8ce38b2c9956758acd217b1b89a085d435bac293a7d11cacd043855fcb999c8d302af42ad8d340af748834013c1875a6da4

  • memory/288-11-0x0000000000160000-0x0000000000164000-memory.dmp

    Filesize

    16KB

  • memory/1168-38-0x0000000002D60000-0x0000000002E60000-memory.dmp

    Filesize

    1024KB

  • memory/2464-43-0x0000000002310000-0x0000000002613000-memory.dmp

    Filesize

    3.0MB

  • memory/2464-40-0x00000000000A0000-0x00000000000DF000-memory.dmp

    Filesize

    252KB

  • memory/2464-48-0x0000000000B10000-0x0000000000BB4000-memory.dmp

    Filesize

    656KB

  • memory/2464-47-0x00000000000A0000-0x00000000000DF000-memory.dmp

    Filesize

    252KB

  • memory/2464-46-0x0000000000B10000-0x0000000000BB4000-memory.dmp

    Filesize

    656KB

  • memory/2464-44-0x00000000000A0000-0x00000000000DF000-memory.dmp

    Filesize

    252KB

  • memory/2464-39-0x00000000000A0000-0x00000000000DF000-memory.dmp

    Filesize

    252KB

  • memory/2556-37-0x0000000000370000-0x0000000000395000-memory.dmp

    Filesize

    148KB

  • memory/2556-42-0x0000000000370000-0x0000000000395000-memory.dmp

    Filesize

    148KB

  • memory/2556-41-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/2556-32-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/2556-33-0x0000000000720000-0x0000000000A23000-memory.dmp

    Filesize

    3.0MB

  • memory/2556-34-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/2556-36-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/2556-35-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB