Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 01:14

General

  • Target

    $TEMP/zwsw.exe

  • Size

    529KB

  • MD5

    2bdd806d45b5a9e1e734875630d4caed

  • SHA1

    bbb0d626d73a716635044158450eed18aee42d49

  • SHA256

    fa91895f07bd633328d862db0dcd09e94298b21e10d92d3da684656981d5416f

  • SHA512

    ff02928a65e0c380565c9e5c2cf2014c81ee8d39177b4c228fa5c5a40599b60821f9c41b6b62e2e8301f11bb96d760a801f20ccc0dfaf0528088914c8b3c8e25

  • SSDEEP

    12288:9Nuwup8S36yKNO4WGmqACUfMMHorpecceHBSM25xTCP:gio6FnWGZATfFye77

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 5 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • Modifies Internet Explorer settings
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /u /s "C:\Program Files (x86)\SearchNet\SNHpr.dll"
      2⤵
        PID:4364
      • C:\Users\Admin\AppData\Local\Temp\rnq4894.tmp
        C:\Users\Admin\AppData\Local\Temp\rnq4894.tmp
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3028
        • C:\Users\Admin\AppData\Local\Temp\48D2\48D2.exe
          "C:\Users\Admin\AppData\Local\Temp\48D2\48D2.exe" 00000402
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4084

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\48D2\48D2.exe

      Filesize

      28KB

      MD5

      b9d4e392e8ac6a4420f126cc88d8c0c1

      SHA1

      3fa9755060979a13973927906222a4929bb4c80f

      SHA256

      3d20d973651546be8d370ff9013bbdc03282808a212731b92852f0b789634064

      SHA512

      03fe62e90efaa0cf064c335d7dd4df912f738a85726eb77269687f398511b883400eb0b95d3a8158d2a5b7fec37e073bbde754a5b53e17732b18f667d9960128

    • C:\Users\Admin\AppData\Local\Temp\48D2\cdnins.dll

      Filesize

      84KB

      MD5

      1f2d2dbf570ecc45a9e2ce45f264199f

      SHA1

      bf0656f98e26754f48eb5908319067641ae51d8d

      SHA256

      766ebfa9689728c545a45cc82cce611a9343bc544fc712dc31881d0f2854296c

      SHA512

      96e41545336d21bf289d203a56e3bf27ed4d3abcbd23332a590f38adc6568a81f3d10f129539e4efdd751be4e02a7d95052b455c04b6ba0a11c8d4c21a2411a0

    • C:\Users\Admin\AppData\Local\Temp\48D2\cdnprh.dll

      Filesize

      52KB

      MD5

      9076a436c1a5cfdc687714982a6cb86f

      SHA1

      66357580e2264f23648714254941b7a61d214237

      SHA256

      000d138eec71e8c16d40a9930c3f0939f7608175f68588d34c07f3a74e71dbde

      SHA512

      4956ddaabb0fa9a783012102d069c3ee05fa64f25bc9c02b4ff86f15e26b0abb5ce9aa5cdfc3a4844a68123eac64784d4b20c774de0d36aa0b71e35e97c3b834

    • C:\Users\Admin\AppData\Local\Temp\48D2\src.dat

      Filesize

      144B

      MD5

      3ab47841cbacd4f95fcc14e5adb758be

      SHA1

      1e8c5f3d741f94f5c85afe4af77d9ce2ddf9e19c

      SHA256

      c7c926fd1865f3c2dccb3ec9bd8aac72da8c80036df874e38fb2644159d6f381

      SHA512

      51e633fcf74383e72a11b266e500c440062a9760850c3e6ac80ab1ae8673cc9428b913cd3c8961a46fb854d561b2eccfb30077b9c3f68706b87924b6db38e997

    • C:\Users\Admin\AppData\Local\Temp\rnq47F6.tmp

      Filesize

      46KB

      MD5

      bf503cb6fe413cb3ba2ebda4ca0d96f8

      SHA1

      40f3e827c2ef381e894cb1e592ef08f0ce0277e5

      SHA256

      fafd103b6fab2b2b243284bdcfcccb2bea87f66fac4cfbc072eef84d72bf4eaf

      SHA512

      bc0ec882d90acbb215fb4d89a7c138a79f6cc46736fc56f870297069b15f3bfda0b6fdf162c67a4fe8211c8419e520c2e25c91cbe22bec307690c042c2a85788

    • C:\Users\Admin\AppData\Local\Temp\rnq4894.tmp

      Filesize

      455KB

      MD5

      34287b9bad575dfe21ce5364755b63af

      SHA1

      15503e83525a14ac31058eb01850f6177a72a706

      SHA256

      27edccdf0def484aa1727d1c6883a9fa1b243b4d55e784b221ae39f68eb6b95f

      SHA512

      5f7595616fb9188c9f0032c215d1d822de6396895e0f8a3a0f8de491a91974f93b6244149d36331e79226891ec512c1287f9039c606000da2df44980244478eb

    • memory/1944-0-0x0000000000400000-0x000000000048E000-memory.dmp

      Filesize

      568KB

    • memory/1944-6-0x0000000010000000-0x0000000010019000-memory.dmp

      Filesize

      100KB

    • memory/1944-16-0x0000000010000000-0x0000000010019000-memory.dmp

      Filesize

      100KB

    • memory/1944-23-0x0000000000400000-0x000000000048E000-memory.dmp

      Filesize

      568KB