Analysis

  • max time kernel
    141s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    21-06-2024 02:00

General

  • Target

    lNV-9088759885958.cmd

  • Size

    4.1MB

  • MD5

    75a6cb4a92d02ef6c1bf0e5088190cb9

  • SHA1

    e99ebb72703971edc6e73f50b03b833fbbe0dde7

  • SHA256

    5c65588d938a6d29b783795576286474107a7989112326cccbecdbdc433f41f3

  • SHA512

    298ec5450835768029318bfb045de38b501eeb41c74e98d4c569da38ca2768fe026b9febc968508857fc9bfcdd3ac6cb4d8c640cdc2631d989e865bc4a2b2af2

  • SSDEEP

    49152:50zbEfxlWCpt6Tz5d1ej30RxqEc0Z6oJYLmNfLIewZTJN6666Iuq66fKID6+6I6h:r

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 7 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\lNV-9088759885958.cmd"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Windows\System32\extrac32.exe
      C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
      2⤵
        PID:2600
      • C:\Users\Public\alpha.exe
        C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2344
        • C:\Windows\system32\extrac32.exe
          extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
          3⤵
            PID:2804
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\lNV-9088759885958.cmd" "C:\\Users\\Public\\Audio.mp4" 9
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2148
          • C:\Users\Public\kn.exe
            C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\lNV-9088759885958.cmd" "C:\\Users\\Public\\Audio.mp4" 9
            3⤵
            • Executes dropped EXE
            PID:2664
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2724
          • C:\Users\Public\kn.exe
            C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12
            3⤵
            • Executes dropped EXE
            PID:2748
        • C:\Users\Public\Libraries\Audio.pif
          C:\Users\Public\Libraries\Audio.pif
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: CmdExeWriteProcessMemorySpam
          PID:2668
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
          2⤵
          • Executes dropped EXE
          PID:2784
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Audio.mp4" / A / F / Q / S
          2⤵
          • Executes dropped EXE
          PID:2528

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Public\Audio.mp4

        Filesize

        3.0MB

        MD5

        24eca41b035ab826934e998b874398b0

        SHA1

        5da0772e30198aa9f489de683880f3b14be6d916

        SHA256

        716743d7e555b18a15ad8aa93ab7b87c456d556425fe716c2b00461973af6c55

        SHA512

        2b4d1b4e623d4e0109403fa8f6f9ddc7a0ff9ac0f6f7373ce1f2c66afe5d926f04b20d0bed85ffe7e254d5f2134af4c322a1aebba15e3bdb0f566ab973855484

      • C:\Users\Public\Libraries\Audio.pif

        Filesize

        1.5MB

        MD5

        ab0d98b37da9c1bd33adec509689fa4e

        SHA1

        4ca1a3f7bd543878dce7104473ee43b2ab783628

        SHA256

        78e62a907f38c42e9eb2ef88ebab24a157e68eeba1210b4d6a2aa0eb919202ff

        SHA512

        d581f6a466c6e432a08b3a550179f88a6bb9cdeba8d0ba97e609201841442014dc04f4170c11ee2f776170941421dfe0873c705785a60301dc4e60668a574567

      • \Users\Public\alpha.exe

        Filesize

        337KB

        MD5

        5746bd7e255dd6a8afa06f7c42c1ba41

        SHA1

        0f3c4ff28f354aede202d54e9d1c5529a3bf87d8

        SHA256

        db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386

        SHA512

        3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

      • \Users\Public\kn.exe

        Filesize

        1.1MB

        MD5

        ec1fd3050dbc40ec7e87ab99c7ca0b03

        SHA1

        ae7fdfc29f4ef31e38ebf381e61b503038b5cb35

        SHA256

        1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3

        SHA512

        4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

      • memory/2668-32-0x0000000000400000-0x0000000000587000-memory.dmp

        Filesize

        1.5MB