Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    15-06-2024 12:49

General

  • Target

    MuMuInstaller_3.1.7.0_gw-overseas12_all_1712735105.exe

  • Size

    5.3MB

  • MD5

    fbd9ad001bb2719f574c0705c5de05fb

  • SHA1

    d07e77a490ad677935ac8213b88237e94440e791

  • SHA256

    f0031f9d7f25d4d29581879f62565a5a565995899adc60213f9e218147c78593

  • SHA512

    5724e3f858ae7ea92ba4ce325f3f8f4b90ecc6d7c19476e2888c4b09f0913463191b977f71314300918cceb0a6ae0b80e29d3c70891e8aeb9314da233a929e96

  • SSDEEP

    98304:oeZOuRuvqAgef1ndGaX6tJJQv2FKA75OpVclc02vDRZTEB:1ZOPNdo3u0jc02vVZoB

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MuMuInstaller_3.1.7.0_gw-overseas12_all_1712735105.exe
    "C:\Users\Admin\AppData\Local\Temp\MuMuInstaller_3.1.7.0_gw-overseas12_all_1712735105.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Users\Admin\AppData\Local\Temp\7z6606D89C\nemu-downloader.exe
      C:\Users\Admin\AppData\Local\Temp\7z6606D89C\nemu-downloader.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Users\Admin\AppData\Local\Temp\7z6606D89C\ColaBoxChecker.exe
        "C:\Users\Admin\AppData\Local\Temp\7z6606D89C\ColaBoxChecker.exe" checker /baseboard
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2244
      • C:\Users\Admin\AppData\Local\Temp\7z6606D89C\HyperVChecker.exe
        "C:\Users\Admin\AppData\Local\Temp\7z6606D89C\HyperVChecker.exe"
        3⤵
        • Executes dropped EXE
        PID:1876
      • C:\Users\Admin\AppData\Local\Temp\7z6606D89C\HyperVChecker.exe
        "C:\Users\Admin\AppData\Local\Temp\7z6606D89C\HyperVChecker.exe"
        3⤵
        • Executes dropped EXE
        PID:788
      • C:\Users\Admin\AppData\Local\Temp\7z6606D89C\HyperVChecker.exe
        "C:\Users\Admin\AppData\Local\Temp\7z6606D89C\HyperVChecker.exe"
        3⤵
        • Executes dropped EXE
        PID:2176

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

    Filesize

    230B

    MD5

    2d3198d7b9752879086d65d72c65480e

    SHA1

    37a96f821bfe0fdca873fe07bd1fe34d2d8126a4

    SHA256

    b336afeff36959c3de311fa003eec817d3efab814f1f904f3889d440fed5c236

    SHA512

    89600b7b49d6b80c5cf0019b0fa7801cf18cf4b62bc6e049a83b6fab8bcbfab4ef7eb3bdd7d6daf2ab65f149b072194d7bf2edd20f5276cc126f81fc36a8424c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    69fd524813dfb9c4536814129f40cf5b

    SHA1

    1f5ce98d59caa343232d765ca803c9e4331fb5b5

    SHA256

    ddb81a9ce70df5df162b28ad164f674028bae13467a378f6cdbc0998076be7af

    SHA512

    57b98faaf96371d8e8383761e11db975a6074d26e05d948e7c2bdc16d2cac3564b90d981b12a93b280c581914d824861ab53fa013e19e032778e5b0fcd420e18

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1fc58efa66a02f8a7fb3ce935a6f9ec1

    SHA1

    dba4f952c9e442d1087cd650a4cc6c923b195381

    SHA256

    26d2e5c64c619bd1e2b5617ef35179e6ef7cb70950031cc7f7932bd8c902a906

    SHA512

    e4863c6404d7c7708f8d3a4c98f55590c839dc3f3d08091782ea50a150294724cbc8c142c2198fbb4c193b02916e2087e1cb550185f6d18b4ed32b4787d1e7c0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cf297be457cb66951579617aabfa7bde

    SHA1

    b30b5837de40812117f082f8c13a0dd6a6410ded

    SHA256

    9857572ce0a1c1776f46fdd044b923636597e65bc9e039dd69687ef28d80f0c7

    SHA512

    341b0a0b7a28e659ff7e8890391dba242830fb9c23c6f7246c6b15ac28fa6437d058eb55ee1a54b5b3a5028c302fbd144a177d7db0dd8e054f4f568cda7412c2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2c13bdb7ba99f263da709bf14d43fc7b

    SHA1

    69095d0653499740934787305adecf3305341012

    SHA256

    81bc726499391aa873c2358299f7a181f7e5933b84ddb1da99b3c6744ca49a3d

    SHA512

    f9e3751a12f5bc9954df81b8ec22a8ac507d3d1e9251c640e1bea907d7d94fe8e38b3fd00f61a05275a5ff18a26b6b6be9b5f3dffc918b3fbda9fb1a05c7b398

  • C:\Users\Admin\AppData\Local\Temp\7z6606D89C\ColaBoxChecker.exe

    Filesize

    4.0MB

    MD5

    839708e3f96cf055436fa08d6205263c

    SHA1

    a4579f8cb6b80fe3fd50099794f63eb51be3292f

    SHA256

    1373c5d006a5dbcd9b86cfff9a37616f1245d1333c4adcefc7cd18926b98d752

    SHA512

    ece67e031e06a0442d935e7d81d0eed57ae92b348b5d104423577478ce226e4a4bde834c54e31d33bfe6f574fb7798ba96886d9e8edb738edee6e7c9c43054cd

  • C:\Users\Admin\AppData\Local\Temp\7z6606D89C\HyperVChecker.exe

    Filesize

    117KB

    MD5

    dbd84c6083e4badf4741d95ba3c9b5f8

    SHA1

    4a555adf8e0459bfd1145d9bd8d91b3fff94aad0

    SHA256

    9ff467bc5a1c377102d25da9fa9c24dcc4375f456510f71584f0714fdfb2af39

    SHA512

    fb5fe74f64254609e07d6642acf904562bb905cd7c14c6f85ba31bcdbaf06686c0586609ec4f5d2f8f55ff90334dcbb774a3a6e78df74bf1b1d0cd03dec21870

  • C:\Users\Admin\AppData\Local\Temp\7z6606D89C\baseboard

    Filesize

    115B

    MD5

    4c70f7af5aeee9e435192b0f74d7a545

    SHA1

    f731ac4ea1c9f08c4aeee8e0c90c375a0f6039d0

    SHA256

    fb9bd12778c4054539695c0fd20eec12e55c815bb65de3646f257d46766e87f9

    SHA512

    79f49a8196ba86ec3d64fabe48218d2d4209357697e4ca64bb3174cc3b39f963955913b4c4f2ad94b6cdf2c26df63bc6b5a3fea36222859e71afddb868317724

  • C:\Users\Admin\AppData\Local\Temp\7z6606D89C\config.ini

    Filesize

    346B

    MD5

    d00fb4c61a255b58ff09886c6c72461b

    SHA1

    4e4f7d7ae36f67a4d6fc8479f8400b3eb769e978

    SHA256

    77dec4d79e1e844a2156f101defc0fc81c138a989e8ba1c722c58feb91b3cd4a

    SHA512

    8494ab9fe0594f3ff7b0893ca3e25d6d0a706e546e92c5b662aa864affcefe5f9721a6a95f37f40cdacf39d27a23e2b3cd5dbca4d7b8909cd7c186209d4b46db

  • C:\Users\Admin\AppData\Local\Temp\7z6606D89C\skin.zip

    Filesize

    509KB

    MD5

    ecb43530caf9566c1b76d5af8d2097f1

    SHA1

    34562ada66cd1501fcb7411a1e1d86729fd7fdc0

    SHA256

    a12381f97aee2d91568f44b23e866ccc99f0ae5e5961f318ed24b72f4f5da80a

    SHA512

    4a243c0bc4dbaf892bee91ea7eff9e6a7732d3aa2df5bebd9a4bea2859a30a8511945ce3bb823f7ef921f2e1a98906fb676fce85f25fd5908646b3a2f5d02563

  • C:\Users\Admin\AppData\Local\Temp\Cab877A.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar8848.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\Temp\7z6606D89C\nemu-downloader.exe

    Filesize

    3.2MB

    MD5

    cdf8047ceae80d9cd9eb798a57bf6084

    SHA1

    8e7971401fada3099aed61849745fda37e1c0d32

    SHA256

    1f01a9abac64fae72e0a253ad9ffe2d62cd2967c1c2bc90fb956ac446fe2b11e

    SHA512

    ac366f38f39b935110192d1355147392ced5a21966cc22386804356dce24b2da7971a6a60d675689f93d74014d961bfb3b0c13cf06809b9f9feef580045e20dc