Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/09/2024, 16:36

General

  • Target

    bba091b2d7cb12b2ff0e6152615652370092a0746208c956509876c1f04d620a.exe

  • Size

    247KB

  • MD5

    7ec52ed75f36e9c33b70aea7680b2d0c

  • SHA1

    3785037b48c3eabfe1c788770101fb8babad1397

  • SHA256

    bba091b2d7cb12b2ff0e6152615652370092a0746208c956509876c1f04d620a

  • SHA512

    bab64bcaf30b49a35cbaa2b4cd2e976365dc43462ff7b9dd8a02c128bfa999b70cf67ec4cc867be67da657bdd60010255dcb0c21747695d2ddc12f5a2b51cde1

  • SSDEEP

    6144:SuJWqml5a6EdkQxiUmRQColKGAOPQK2GwIgfx+qSfF0:Pml5a6EdkQgUmR7G9QK3wJx+qSfF0

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3464
      • C:\Users\Admin\AppData\Local\Temp\bba091b2d7cb12b2ff0e6152615652370092a0746208c956509876c1f04d620a.exe
        "C:\Users\Admin\AppData\Local\Temp\bba091b2d7cb12b2ff0e6152615652370092a0746208c956509876c1f04d620a.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:540
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B27.bat
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4400
          • C:\Users\Admin\AppData\Local\Temp\bba091b2d7cb12b2ff0e6152615652370092a0746208c956509876c1f04d620a.exe
            "C:\Users\Admin\AppData\Local\Temp\bba091b2d7cb12b2ff0e6152615652370092a0746208c956509876c1f04d620a.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1176
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1728
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3644
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3008

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\7-Zip\7z.exe

            Filesize

            573KB

            MD5

            3b8937ea077f65ec012e6849c202cfdb

            SHA1

            7fae29716bcc111d9d3c299363b561d4ea385d04

            SHA256

            78db9398d45a9b977b8dd0128b8bd2e41bb5cbdaf9929d639e27351ed98f2e7c

            SHA512

            8725be06ded6b4a9f485a1219f2d9de3ae657e8a85794c2c8009ec082c5663bc57611f55b539d801814220709a55765304ec1b04765fc336d14b5343fa1278db

          • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

            Filesize

            639KB

            MD5

            ad5a7e5eb1a1cdd791957e07c93748ae

            SHA1

            6e4f8c5f4d791327e11d0d68ca6f514554af8481

            SHA256

            cfee92d916fbbb95d8282c3264d3708ad1ddfdd9db4daaf00e0c96a22854c4dc

            SHA512

            a8acd191aec48dac8d5808a93ee973ea52793140e318b4d870fb10e4e8ba0756fe95654134dd1c175168375a0f7caebfd8a7d46a9b3dc71006f830b53dd9fefe

          • C:\Users\Admin\AppData\Local\Temp\$$a9B27.bat

            Filesize

            722B

            MD5

            49bc658c2079e15c53204fb9377fb24a

            SHA1

            8505fcc752aa48ad45ffb8a99b9f4935f9c903d6

            SHA256

            1aa8f9f7182c8b632fedcd73a9c11709cafdc586baa3e4ad7b617a53c19c4059

            SHA512

            092383ddf5a478b7a0388969b6467b8202f2048727d016a525a08bdc603c789c0c5b7ccc8d99b79bda802594061caa7c4e70d6588f83c69bbc027fd1a3078842

          • C:\Users\Admin\AppData\Local\Temp\bba091b2d7cb12b2ff0e6152615652370092a0746208c956509876c1f04d620a.exe.exe

            Filesize

            217KB

            MD5

            021c57c74de40f7c3b4fcf58a54d3649

            SHA1

            ef363ab45b6fe3dd5b768655adc4188aadf6b6fd

            SHA256

            04adf40ba58d0ab892091c188822191f2597bc47dab8b92423e8fc546dc437ef

            SHA512

            77e3bbb08c661285a49a66e8090a54f535727731c44b7253ea09ffe9548bae9d120ef38a67dfa8a5d8da170dde3e9c1928b96c64dfc07b7f67f93b478937c018

          • C:\Windows\rundl132.exe

            Filesize

            29KB

            MD5

            3d2370b1a6ab3ea2c9edd2ea27d8bc5c

            SHA1

            3be9754c3a1305ab58337e7412a384259d1da910

            SHA256

            46d6ac3cdd7b6e5860d9bd7ac428d1b83910ab1d534ea1c24102f281619cde87

            SHA512

            b02ae7cafe3469a4a5a03a19862774e52186a0b7305865807457af1d828c0dfbc52755c89b0c0caaab7fe9828fe948d91b8ea8a1ff1a9a5a73efc7a334faa805

          • F:\$RECYCLE.BIN\S-1-5-21-2412658365-3084825385-3340777666-1000\_desktop.ini

            Filesize

            8B

            MD5

            5d65d1288c9ecedfd5f28d17a01a30bc

            SHA1

            e5bb89b8ad5c73516abf7e3baeaf1855154381dc

            SHA256

            3501728ad227b52ce4d4f85ddd0e6d28dfa7acce977ae27f1e337be209825a5f

            SHA512

            6177ce001dd535382c3bae5e8c3cfda85d8d8b76b68bce10fa8e5e1e748fd1512a531ffc93fef1316f2c27d93b5b4a5b60a6391f0e131ccc5cc0a65c2755868e

          • memory/540-0-0x0000000000400000-0x0000000000436000-memory.dmp

            Filesize

            216KB

          • memory/540-9-0x0000000000400000-0x0000000000436000-memory.dmp

            Filesize

            216KB

          • memory/1728-26-0x0000000000400000-0x0000000000436000-memory.dmp

            Filesize

            216KB

          • memory/1728-32-0x0000000000400000-0x0000000000436000-memory.dmp

            Filesize

            216KB

          • memory/1728-36-0x0000000000400000-0x0000000000436000-memory.dmp

            Filesize

            216KB

          • memory/1728-19-0x0000000000400000-0x0000000000436000-memory.dmp

            Filesize

            216KB

          • memory/1728-561-0x0000000000400000-0x0000000000436000-memory.dmp

            Filesize

            216KB

          • memory/1728-1233-0x0000000000400000-0x0000000000436000-memory.dmp

            Filesize

            216KB

          • memory/1728-4791-0x0000000000400000-0x0000000000436000-memory.dmp

            Filesize

            216KB

          • memory/1728-12-0x0000000000400000-0x0000000000436000-memory.dmp

            Filesize

            216KB

          • memory/1728-5236-0x0000000000400000-0x0000000000436000-memory.dmp

            Filesize

            216KB