c27724b9397359fb47bc58c099b631617c8e4136677986f0b59548888f5dc729

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

WindowController_setup_01.exe
Size

1.4MB
MD5

cbb042c279c90e63becb2aa3dfb9ee07
SHA1

0d6300469924c70141d16054aea0d8048bf1f377
SHA256

d6a4c190874e0f3e25b30acbb750b26b772fd58bd947c729a40b8fd0858dcaa1
SHA512

31e6a4efcef066fc40446ae20adc1df75e6e953bae9238de436af999a654b4200c5e8bdc44ea6b9512e6cc1c4a5b46fae267f40ff33f24d9e82f192d51f828ce
SSDEEP

24576:unvUEZlqA8+B4fmdcN/3Jt6iQaDnY6Uk22+U6nMZf9vR40tt++/q:uvRbBKN/PTQaDflZfRr+

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2356	WindowController_setup_01.tmp

Loads dropped DLL 3 IoCs

pid	Process
2696	WindowController_setup_01.exe
2356	WindowController_setup_01.tmp
2356	WindowController_setup_01.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2356	WindowController_setup_01.tmp

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2356	2696	WindowController_setup_01.exe	30
PID 2696 wrote to memory of 2356	2696	WindowController_setup_01.exe	30
PID 2696 wrote to memory of 2356	2696	WindowController_setup_01.exe	30
PID 2696 wrote to memory of 2356	2696	WindowController_setup_01.exe	30
PID 2696 wrote to memory of 2356	2696	WindowController_setup_01.exe	30
PID 2696 wrote to memory of 2356	2696	WindowController_setup_01.exe	30
PID 2696 wrote to memory of 2356	2696	WindowController_setup_01.exe	30
PID 2356 wrote to memory of 2936	2356	WindowController_setup_01.tmp	31
PID 2356 wrote to memory of 2936	2356	WindowController_setup_01.tmp	31
PID 2356 wrote to memory of 2936	2356	WindowController_setup_01.tmp	31
PID 2356 wrote to memory of 2936	2356	WindowController_setup_01.tmp	31

C:\Users\Admin\AppData\Local\Temp\WindowController_setup_01.exe
"C:\Users\Admin\AppData\Local\Temp\WindowController_setup_01.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\is-OKDCD.tmp\WindowController_setup_01.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-OKDCD.tmp\WindowController_setup_01.tmp" /SL5="$400EE,1174435,54272,C:\Users\Admin\AppData\Local\Temp\WindowController_setup_01.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\del_bat.cmd""
    3⤵
    PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\del_bat.cmd

Filesize
226B

MD5
4b4b8f5b3f7dc83fa8ea016acb289451

SHA1
af123e212413f74ea357587ddd3e3feeedc465df

SHA256
288981c42288ced83c3829000c41a76bde49a3c4877cd3c5ff63bf6d11a8fd30

SHA512
52bf2fc93590314c3213b0f80c3b4605869fe344478fbe02e719890e35166b62ba0d1b91db0e3c1f92e13173f223f2f7e666d563cc2aa3cc88afc35e282c06f2

Download Submit
\Users\Admin\AppData\Local\Temp\is-D3R9H.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-OKDCD.tmp\WindowController_setup_01.tmp

Filesize
692KB

MD5
68d74e27919dc35df846ae023391a38a

SHA1
3f94254fdb0d1fcaf028c71ae2017b82cb01344c

SHA256
65e3bb3d09773ee3bf2cca941de035c59b356911553d232a6f2ecacdd08115a4

SHA512
0c2e1ffd0d5e5b458d38b9f4d49aae25703bd7730f453537836d533829dad380610b31cbd234db39e997090827fa8ce7a52b574ad04b7d7b4ceed58f2ed09a8a

Download Submit
memory/2356-8-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2356-19-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2696-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2696-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2696-18-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads