Analysis

  • max time kernel
    121s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    10-07-2024 07:54

General

  • Target

    PO#8586.exe

  • Size

    584KB

  • MD5

    1b3338a849721abf60efec1f28901ffa

  • SHA1

    6da8a229ee3aaa589f161d1bf9b16f0cd5118730

  • SHA256

    53a75b58c18af831e5df638291570b99235bf9e4b4ce9e4fca7cd13da3df6f25

  • SHA512

    620634f18536dd1b06143814015423307e25f47e1336a3f9cf47ddadd2daaa462459ea6ae38fd0792532d6fe05433f988418006e91fd04a55f4e341ee89cc70b

  • SSDEEP

    12288:VmnpcT6/18retJCCWZFv28MC6YWPCPFhenvh1dZk7SBu:Vmn2iZIdnMCOC3ep1U7SBu

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO#8586.exe
    "C:\Users\Admin\AppData\Local\Temp\PO#8586.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 520
      2⤵
      • Program crash
      PID:2104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Common Files\overtyde.ini

    Filesize

    40B

    MD5

    0588a5641b3acef5cd5e0fced8286529

    SHA1

    c4465e00f4260c677c678f27924352e70706d1ad

    SHA256

    d802a2ae71bb03d382576bfb3f3cb9dcf58387cdc7d8577614fc0a6b3eb071a1

    SHA512

    faa408f26430d05a6263b8ee22cf64eebf2148708a161f91458b10b826e3c9b7773ec6e089cc0eb59acb6c7d94aebea8c5ddd70241457c0b89ca69e1df8b6b32

  • C:\Users\Admin\AppData\Local\Spumoid.lnk

    Filesize

    882B

    MD5

    67e9cf5fc1938c927afe0eb70c584458

    SHA1

    4207e26317b9d015f0dba8e2e19c58e3919f2c4a

    SHA256

    e91a5fe45166bbb9c7b3865db3dd86c0cdc89cb8bc9821c85945d5816e46cb98

    SHA512

    c42538be94b98f4da7478e1762bd522b823032ee7d809b07cc68b7f3d8a497e38e24ed587f3007b93c76791d269f5ad92c5eae279c396771c9962abd5881cb3f

  • C:\Users\Admin\AppData\Local\Temp\nsd5ABE.tmp

    Filesize

    46B

    MD5

    46bc3b3f30f2703822d77228cf71c47f

    SHA1

    880c185810ea2b075648c9d0aac41487c8383059

    SHA256

    8bf4c616c9a55aafdc1a48ebdb11f8fbea6fb2465aa2f216e4efad6d540a1d99

    SHA512

    b8dd0e24989ee9acf9eb6b86dfb7f87d1d11f96458981170b7557aa1e26bb995a9ff785c8a98a54327ab12a7868d9c404b221e5f09e401d431dbb0120042946d

  • C:\Users\Admin\AppData\Local\Temp\nsd5ABE.tmp

    Filesize

    74B

    MD5

    16d513397f3c1f8334e8f3e4fc49828f

    SHA1

    4ee15afca81ca6a13af4e38240099b730d6931f0

    SHA256

    d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36

    SHA512

    4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3

  • C:\Users\Admin\AppData\Local\Temp\nsd5ABE.tmp

    Filesize

    26B

    MD5

    bc970bd8ec8acf8ac1ada9e444673a39

    SHA1

    6c03dfa1c2595129e8e0e2428fceb0f2df7f82a7

    SHA256

    0092de36b51381e4fe5e613bdbae906f0c6e8691fec4a93f82b876f1af826648

    SHA512

    c3fc2d8b396b6753759b532bb9e91d015a039476ec2cf8abcd4c6d4d32b9305146752743692486bd4e3984325a7e9c6db0ff4d902c2879993789573f9cdca3b0

  • C:\Users\Admin\AppData\Local\Temp\nso5EF7.tmp

    Filesize

    4B

    MD5

    cde63b34c142af0a38cbe83791c964f8

    SHA1

    ece2b194b486118b40ad12c1f0e9425dd0672424

    SHA256

    65e2d70166c9a802b7ad2a87129b8945f083e5f268878790a9d1f1c03f47938d

    SHA512

    0559d3d34ad64ccc27e685431c24fc6ead0f645db14fa0e125a64fb67dbd158c15432c1fc5407811aac8a3486090dfbcfcbc3c6bf5aa0ec73f979ef62d14853c

  • C:\Users\Admin\AppData\Local\Temp\nso5EF7.tmp

    Filesize

    7B

    MD5

    67cfa7364c4cf265b047d87ff2e673ae

    SHA1

    56e27889277981a9b63fcf5b218744a125bbc2fa

    SHA256

    639b68bd180b47d542dd001d03557ee2d5b3065c3c783143bc9fb548f3fd7713

    SHA512

    17f28a136b20b89e9c3a418b08fd8e6fcaac960872dc33b2481af2d872efc44228f420759c57724f5d953c7ba98f2283e2acc7dfe5a58cbf719c6480ec7a648b

  • C:\Users\Admin\AppData\Local\Temp\nso5EF7.tmp

    Filesize

    8B

    MD5

    c3cb69218b85c3260387fb582cb518dd

    SHA1

    961c892ded09a4cbb5392097bb845ccba65902ad

    SHA256

    1c329924865741e0222d3ead23072cfbed14f96e2b0432573068eb0640513101

    SHA512

    2402fffeb89c531db742bf6f5466eee8fe13edf97b8ecfc2cace3522806b322924d1ca81dda25e59b4047b8f40ad11ae9216e0a0d5c7fc6beef4368eb9551422

  • C:\Users\Admin\AppData\Local\Temp\nso5EF7.tmp

    Filesize

    44B

    MD5

    556e3b35bb191bcec8b2ee2bed0f51e7

    SHA1

    7e529327fd64604aebe756cc07e837acddccf1c5

    SHA256

    7978a31934d6a6e427342480ff47382d9108a6b4730bf05477235fa83a59c53e

    SHA512

    9ebcfabdb7579d4c77b45ca1cc2519b62ec8ca33d4029d40b967f31428a478b683bdda50eb29ce7d239268a4257c197ba6faae5241fa21c78b5a3ea7a8ab63d6

  • C:\Users\Admin\AppData\Local\Temp\nst5D41.tmp

    Filesize

    1B

    MD5

    8ce4b16b22b58894aa86c421e8759df3

    SHA1

    13fbd79c3d390e5d6585a21e11ff5ec1970cff0c

    SHA256

    8254c329a92850f6d539dd376f4816ee2764517da5e0235514af433164480d7a

    SHA512

    2af8a9104b3f64ed640d8c7e298d2d480f03a3610cbc2b33474321ec59024a48592ea8545e41e09d5d1108759df48ede0054f225df39d4f0f312450e0aa9dd25

  • C:\Users\Admin\AppData\Local\Temp\nst5D41.tmp

    Filesize

    2B

    MD5

    25bc6654798eb508fa0b6343212a74fe

    SHA1

    15d5e1d3b948fd5986aaff7d9419b5e52c75fc93

    SHA256

    8e5202705183bd3a20a29e224499b0f77a8273ee33cd93cca71043c57ad4bdfc

    SHA512

    5868c6241ed3cfcc5c34bfe42e4b9f5c69e74975e524771d8c9f35cafc13fd01cd943ec4d8caefee79a1f4a457e69d20b7a86f88db83a5bc3e6bd8a619972898

  • C:\Users\Admin\AppData\Local\Temp\nst5D41.tmp

    Filesize

    3B

    MD5

    4e27f2226785e9abbe046fc592668860

    SHA1

    28b18a7f383131df509f7191f946a32c5a2e410c

    SHA256

    01a219245e1501fee01ce0baea8f6065ce5162cea12fa570689a07c9717be81d

    SHA512

    2a23585835bdb5db8175cab265566042282841efdcee8aaba8b9b5d466b0f165c0c5973033ce94bb9a8f07a956689247981ea07ac5a51408263e1653d9710adb

  • C:\Users\Admin\AppData\Local\Temp\nst5D41.tmp

    Filesize

    6B

    MD5

    50484c19f1afdaf3841a0d821ed393d2

    SHA1

    c65a0fb7e74ffd2c9fc3a0f9aacb0f6a24b0a68b

    SHA256

    6923dd1bc0460082c5d55a831908c24a282860b7f1cd6c2b79cf1bc8857c639c

    SHA512

    d51a20d67571fe70bcd6c36e1382a3c342f42671c710090b75fcfc2405ce24488e03a7131eefe4751d0bd3aeaad816605ad10c8e3258d72fcf379e32416cbf3b

  • C:\Users\Admin\AppData\Local\Temp\nst5D41.tmp

    Filesize

    12B

    MD5

    558ec0e73952eb4a395e7f17eb69221e

    SHA1

    d1cb97bfc8d9fad9eab7d19e685029b5f7084709

    SHA256

    4d8a1cb0f83d824cec9e15e4d45605ed2cc92ae959602d0cc8873b0125d4cd74

    SHA512

    698fb90fadb2b22ce78f874dac04c2f0bf72340d39f135e7736afdb9a9b28c9c55a8c6c9f871676134e6d057a90afc2944d1f1e8a117cc0f7a90c8d9b60c5dbe

  • C:\Users\Admin\AppData\Local\Temp\nst5D41.tmp

    Filesize

    18B

    MD5

    cd0c38af71efb097ce402c588b17ff09

    SHA1

    8da4e54a7b95932f752a88ea416fa31d0c7c2fbe

    SHA256

    1630fc3705a57982a8939a6550615a92d8998f0c3394caeca0ae3019427ec50a

    SHA512

    03603368dbca419de6ad8ef10bb6c9670e83f06d2b3b7d7b5ebccf255473d7abb1cca1c7e0f2c2d49cd3f84c599ee5e71b03582567c95f3f76d5e54931a6ed06

  • \Users\Admin\AppData\Local\Temp\nsy5BD8.tmp\System.dll

    Filesize

    11KB

    MD5

    e23600029d1b09bdb1d422fb4e46f5a6

    SHA1

    5d64a2f6a257a98a689a3db9a087a0fd5f180096

    SHA256

    7342b73593b3aa1b15e3731bfb1afd1961802a5c66343bac9a2c737ee94f4e38

    SHA512

    c971f513142633ce0e6ec6a04c754a286da8016563dab368c3fac83aef81fa3e9df1003c4b63d00a46351a9d18eaa7ae7645caef172e5e1d6e29123ab864e7ac

  • memory/2332-581-0x00000000038E0000-0x0000000004B18000-memory.dmp

    Filesize

    18.2MB

  • memory/2332-582-0x00000000038E0000-0x0000000004B18000-memory.dmp

    Filesize

    18.2MB