f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2

Analysis

max time kernel
95s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe
Size

1.2MB
MD5

37bfbdc59bf8d8228410866b1e8b7221
SHA1

33e543f255ed6bf70e9739f751baf1c1e4c34a00
SHA256

f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2
SHA512

c23161ac77982e58dcc0f95947f06b12934d41183e3130e93d81fd101495bc157d14988ad0a4ccdb45a46866b3cebfa1117a6e01662d8fde15c54f11b4f1f28e
SSDEEP

24576:4jakjfsKRSQ35Lv0qfYlQXHmZAGNYAZrBW:4ujQpQRleHqXZrBW

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2920	BI.exe

Loads dropped DLL 6 IoCs

pid	Process
1904	f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe
1904	f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe
2920	BI.exe
2920	BI.exe
2920	BI.exe
1904	f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3824	1904	WerFault.exe	79

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1904	f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe
1904	f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe
1904	f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe
1904	f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe
1904	f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe
1904	f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe
1904	f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe
1904	f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe
1904	f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe
1904	f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2920	1904	f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe	83
PID 1904 wrote to memory of 2920	1904	f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe	83
PID 1904 wrote to memory of 2920	1904	f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe	83

C:\Users\Admin\AppData\Local\Temp\f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe
"C:\Users\Admin\AppData\Local\Temp\f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\nso75DD.tmp\BI.exe
  C:\Users\Admin\AppData\Local\Temp\nso75DD.tmp\BI.exe { "json_send_time" : "5/7/2024 9:46:37:599" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "246613" , "user_type" : "NULL" , "result" : "Success" , "user_operating_system_bits" : "" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "" , "user_acount_type" : "" , "user_ie_version" : "" , "user_default_browser_version" : "" , "user_default_browser" : "" , "user_service_pack" : "" , "user_operating_system" : "" , "revision_number" : "0" , "build_id" : "00000000" , "dm_version" : "1.3.7.8_HF8" , "bundle_id" : "23ddfd90-e9b5-4f86-a094-28479bf79794" , "machine_user_id" : "{71667847-A4E0-4677-957A-1FECC215EEED}" , "send_attempt" : "0" , "channel_id" : "" , "installation_session_id" : "338D8862-84FC-44E4-828F-EB59FB67C4CD" , "publisher_internal_id" : "1" , "publisher_id" : "Brothersoft" , "publisher_account_id" : "Brothersoft" , "order" : "1.0" , "phase" : "Init" , "Is_Test" : "0" }
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 2328
  2⤵
  - Program crash
  PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1904 -ip 1904
1⤵
PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nse7689.tmp\inetc.dll

Filesize
29KB

MD5
69f10f991b3eb6fda3fd4813be4fc87d

SHA1
2583ffa11b89f907b80b78614ba27f0a911d5aab

SHA256
9855aaa371f7f27796b2bdd3d935a8dbd52dada91309af0d537ed8f5b7a583ae

SHA512
1ee8e44a569a0dd8668bf6d54bd2efec8ea09424668409d8f216ad37cc40c60d2ebc411960ba63c60d81fd4bd719a507a7678241aa2f3b51c77a155f5f7d6c0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso75DD.tmp\BI.exe

Filesize
83KB

MD5
0c5a26a60bda315abe34b46d79a34cb5

SHA1
fc1188b5f136fab9909eee42d4528ae3e6357916

SHA256
70143201f13ce305ae958ada21aa6a03ba58035e1b6eead330c70f716f938663

SHA512
15f3b932375244d2bf61128ebbb47439a9c25bc1d7b0dc52acfe7e128064e7de641a47535d4a90724f8fc321b122d526c4d36b9602782a41d0a15041a6dafd13

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso75DD.tmp\System.dll

Filesize
17KB

MD5
a4f38d1c7a480f5da1bb8097b8b939db

SHA1
b3129c2a0e61881381463f5e0cbbffa573daa845

SHA256
e1180e1e3344c7536150275e33de53dc1dd1a3ca03be66c4d4875fe5bcd4e436

SHA512
fed89f7ee9364fc2f4b9f82c4563713497043947e98dbb03e7d755681adf3ae661aba80d08e59988a23695fc64481b69d9842b7ec7d2b572cc872c4c9957febc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso75DD.tmp\WebApp\Js\API.js

Filesize
9KB

MD5
0c1797a7fe8c65cf36ca5bc35aad0ff7

SHA1
b2754700c45211e641a59c1ddf55f47d55d43bdc

SHA256
85ec98a0fc8ff6c202e0a01142814a5a5438a71636a4025a2a8506cc7b22edba

SHA512
76e5eefc894f815099e8360d89253505b8f29974b71d63e0a5e0636e6db9f8793bf11e992140b89d478a856402741222ad0bf2acff72f95d13fb60b370b13231

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso75DD.tmp\WebApp\Js\json2.js

Filesize
3KB

MD5
9b8cf1c97726c080629c98ddec68bebd

SHA1
5d764a5bc2e5cbb5f2569336e4c0c5f472d07f35

SHA256
1b6c626d6a600be68b11133c7bcd32fbcc8015951037bb36beaa067914367715

SHA512
67c590d216e73d0dd58974567dc248e0adb363c59e318efe1e715960a38220c1cfb98328cdb69941888f9e039d60980fd1fcf11084498fcb46f80c135cb60d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso75DD.tmp\WebApp\Loading.htm

Filesize
3KB

MD5
383c888ce1b2a0430079ec4c0ba0089c

SHA1
b2a68682fee9856e9d23f00f3ff60d87759a3bfd

SHA256
a652514ccc5a33354e5c89d178d49a5e2d69f605dd34234bb28091d4f44d523b

SHA512
3253ab2980c5f1b895cc73f91e568e1337095dc6eb616e7b1f131b084945f3e98e84f861d1848e777c77863a864101463c5865f260fec6d8e1bbf896a9682632

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso75DD.tmp\inetc.dll

Filesize
29KB

MD5
ee9f5f23a8757923484e02e4dee3aea4

SHA1
f60058e0c942874ad3414319e39427ed25589d5d

SHA256
eb10da974b6f87986897131c0703fb3305114864fcc220900aeabea0d0248241

SHA512
7df5017042899771e3862e3e1be19b7782a421f37caaa0ffe8f52c3b76f446d0b61e8c18950204893c6332d51b2dc490da3fa94c7ca7979aac7bf247af2f1e35

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso75DD.tmp\webapphost.dll

Filesize
711KB

MD5
48a425482a174c711609aa3decfc1ac1

SHA1
0e5e75c2350b784c30fa9abc3981efabc3229160

SHA256
650f59f7acd05554ab5c77c6274e33d0c31273b6c3c37ef45744c8994b542d4e

SHA512
cecfb20ef24cd13fa014a4e4a96f7ceaf79d34df7f22404a82fdcc054eb09de4d17e883495fd6ff0cd4902fb5963050c3c512699f4bcd78cebaf7cdc825d0ba8

Download Submit