df2b7f274c484ae5baecb3365b1d9fcc4821facf327ce87724b1be597d0c70a9

Resubmissions

25-06-2024 14:19

240625-rm6bxsvdkb 6

21-06-2024 15:11

240621-sknjrsygjm 6

17-06-2024 17:09

240617-vn6wmawhlb 10

14-06-2024 13:23

240614-qmxjcawdmm 10

Analysis

max time kernel
60s
max time network
17s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
17-06-2024 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FileCenterSetup12.0.16.0.exe
Size

300.4MB
MD5

123556b83a3dad2f59e76602768e9536
SHA1

b402ded286fff73aaf9b32f075bc32029da6d461
SHA256

df2b7f274c484ae5baecb3365b1d9fcc4821facf327ce87724b1be597d0c70a9
SHA512

bc8dc366b404756a55ab40b66bbcccc8d8b366b0f34938c14324d994118602f0be876eaa61234c18eef7ae4e797789da8dd996f023f0f67c0e053e8022dd3506
SSDEEP

6291456:f7u0oceu41pUlsFqvFyeGCIOo7qgB5Fapf5NN9nAug:T9r4vXi5IOyJmfAx

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

FileCenterSetup12.0.16.0.tmpFileCenterUtils.exeFileCenterUtils.exe

pid process

1224 FileCenterSetup12.0.16.0.tmp
4572 FileCenterUtils.exe
3612 FileCenterUtils.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

FileCenterUtils.exeFileCenterUtils.exe

pid process

4572 FileCenterUtils.exe
4572 FileCenterUtils.exe
3612 FileCenterUtils.exe
3612 FileCenterUtils.exe

pid	process
1224	FileCenterSetup12.0.16.0.tmp
4572	FileCenterUtils.exe
3612	FileCenterUtils.exe

pid	process
4572	FileCenterUtils.exe
4572	FileCenterUtils.exe
3612	FileCenterUtils.exe
3612	FileCenterUtils.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

FileCenterSetup12.0.16.0.exeFileCenterSetup12.0.16.0.tmp

description	pid	process	target process
PID 4016 wrote to memory of 1224	4016	FileCenterSetup12.0.16.0.exe	FileCenterSetup12.0.16.0.tmp
PID 4016 wrote to memory of 1224	4016	FileCenterSetup12.0.16.0.exe	FileCenterSetup12.0.16.0.tmp
PID 4016 wrote to memory of 1224	4016	FileCenterSetup12.0.16.0.exe	FileCenterSetup12.0.16.0.tmp
PID 1224 wrote to memory of 4572	1224	FileCenterSetup12.0.16.0.tmp	FileCenterUtils.exe
PID 1224 wrote to memory of 4572	1224	FileCenterSetup12.0.16.0.tmp	FileCenterUtils.exe
PID 1224 wrote to memory of 4572	1224	FileCenterSetup12.0.16.0.tmp	FileCenterUtils.exe
PID 1224 wrote to memory of 3612	1224	FileCenterSetup12.0.16.0.tmp	FileCenterUtils.exe
PID 1224 wrote to memory of 3612	1224	FileCenterSetup12.0.16.0.tmp	FileCenterUtils.exe
PID 1224 wrote to memory of 3612	1224	FileCenterSetup12.0.16.0.tmp	FileCenterUtils.exe

C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe
"C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4016

C:\Users\Admin\AppData\Local\Temp\is-8TQBQ.tmp\FileCenterSetup12.0.16.0.tmp
"C:\Users\Admin\AppData\Local\Temp\is-8TQBQ.tmp\FileCenterSetup12.0.16.0.tmp" /SL5="$601A8,314098152,831488,C:\Users\Admin\AppData\Local\Temp\FileCenterSetup12.0.16.0.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224

C:\Users\Admin\AppData\Local\Temp\is-UOLP0.tmp\FileCenterUtils.exe
"C:\Users\Admin\AppData\Local\Temp\is-UOLP0.tmp\FileCenterUtils.exe" -S -INFO "-1" "3" "11" "C:\Users\Admin\AppData\Local\Temp\is-UOLP0.tmp\FileCenterUtilsInfo.ini"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4572

C:\Users\Admin\AppData\Local\Temp\is-UOLP0.tmp\FileCenterUtils.exe
"C:\Users\Admin\AppData\Local\Temp\is-UOLP0.tmp\FileCenterUtils.exe" -S -INFO "-1" "3" "11" "C:\Users\Admin\AppData\Local\Temp\is-UOLP0.tmp\FileCenterUtilsInfo.ini"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3612

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-8TQBQ.tmp\FileCenterSetup12.0.16.0.tmp
Filesize
3.0MB

MD5
0acf3c16e6faca9c0aec525f53d03866

SHA1
5c3960b48d2b72ad02e59470d8a7b690ee826f9e

SHA256
2c470730bf3efa3f4a9dc184548abefbab8c4aecc43e14834c5810159019c151

SHA512
17d98a3b52eb89e02a371f1d6effa59f624696cd14b0589fe436640ddbe04fc6c5d82834f73699dbaa32a7a69343f82863820e72e225e17d710c4de5102b46c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UOLP0.tmp\FileCenterUtils.exe
Filesize
8.7MB

MD5
e9638374a27160513f1a62827b6cf102

SHA1
b9da58896020d46c4ef16f8f1b332d5f6c1e6f0f

SHA256
c064ba394872e6a8277a5c71b50da34b800d682e403c6b80ec3ba37badf38942

SHA512
9632c8416f542dc96f22a0ddcd109e85c29368b1263d86f74bab39aae8e9271a7b3e2eea18932cf4e3fb5e269d3892016b878d29fb6dad002db11367849f293c

Download Submit
memory/1224-6-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/1224-14-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/1224-24-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/1224-26-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/3612-22-0x0000000001120000-0x0000000001BB6000-memory.dmp

Filesize
10.6MB

Download
memory/4016-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4016-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/4016-13-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4016-28-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4572-12-0x0000000001120000-0x0000000001BB6000-memory.dmp

Filesize
10.6MB

Download