Analysis

  • max time kernel
    149s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2024, 23:06

General

  • Target

    e52e53d01b28b219e4d73968ab622bcdaa75bbdf6d5d664c479e133041edec52.exe

  • Size

    893KB

  • MD5

    7ec8a9f45d3bdc8d6a4f0136395bd07c

  • SHA1

    937a00b209de16bd35061796899fac691058b88f

  • SHA256

    e52e53d01b28b219e4d73968ab622bcdaa75bbdf6d5d664c479e133041edec52

  • SHA512

    7d58b572067b57315f4d6cce88a6cad147a8a6b9e247356b0a2cec67f119b70eec0baeb25f5f82d4dde3867bfe6ff3b2ee40cf83b4e1b194684aa782c8cb8bd6

  • SSDEEP

    12288:tQcDD6i1zuxxZWm+ljKWaladVakMl9TT1fLeH2e4TQnKoCRagc:Ky6i1zuxw7ljsarakkqt4jtwR

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3492
      • C:\Users\Admin\AppData\Local\Temp\e52e53d01b28b219e4d73968ab622bcdaa75bbdf6d5d664c479e133041edec52.exe
        "C:\Users\Admin\AppData\Local\Temp\e52e53d01b28b219e4d73968ab622bcdaa75bbdf6d5d664c479e133041edec52.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1912
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7261.bat
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3624
          • C:\Users\Admin\AppData\Local\Temp\e52e53d01b28b219e4d73968ab622bcdaa75bbdf6d5d664c479e133041edec52.exe
            "C:\Users\Admin\AppData\Local\Temp\e52e53d01b28b219e4d73968ab622bcdaa75bbdf6d5d664c479e133041edec52.exe"
            4⤵
            • Executes dropped EXE
            PID:5108
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1432
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1904
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1404

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

      Filesize

      247KB

      MD5

      e440b5bbbbcce84e067fd7e5ea90ab24

      SHA1

      b1479b7652e9775e459133e69e0f9b90a1b2a785

      SHA256

      a8480343324ee591d772de83c6d956258cb7d37c505b9155e9a7aef4df5aa3ff

      SHA512

      e28e2546486cbb1b59b4ab93a5d8a202e6d6eab8cbfa4e96b3436694a47a5b9e7628b55eb473be19d16ecd751ac81b7a4a622f598ee81e2275b7c9a7a7582e20

    • C:\Program Files\7-Zip\7z.exe

      Filesize

      573KB

      MD5

      2ab6e8b7aab48ca2c3ce6355d99e0412

      SHA1

      0497cb4608490d89e0d6d142fec80495041aa79c

      SHA256

      7fc89158149be43ce900c001fa51b3136f604268cab2e249a51b2d51aca30d15

      SHA512

      77db9d50da415b7d632b350df9dfe3d0de67bb33ca9cacba81531be1c32fdf72a87bbfe0aa18d222abff4c613326d81d3682a3c6065c91ba4c358e039ae74b08

    • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

      Filesize

      639KB

      MD5

      ad5a7e5eb1a1cdd791957e07c93748ae

      SHA1

      6e4f8c5f4d791327e11d0d68ca6f514554af8481

      SHA256

      cfee92d916fbbb95d8282c3264d3708ad1ddfdd9db4daaf00e0c96a22854c4dc

      SHA512

      a8acd191aec48dac8d5808a93ee973ea52793140e318b4d870fb10e4e8ba0756fe95654134dd1c175168375a0f7caebfd8a7d46a9b3dc71006f830b53dd9fefe

    • C:\Users\Admin\AppData\Local\Temp\$$a7261.bat

      Filesize

      722B

      MD5

      c3fd272de949ac3f48dcab5a65b810e5

      SHA1

      1899e4da7ecc14dd968bde91f49858bf786ed0b6

      SHA256

      ca9548cae97b76b16c0967eb292ed9b123538bb1813333745fa10bc09dc0203b

      SHA512

      88102d215174e241d4353d406821fa203dfb2d24434eff3e8ddfef8d5f290b795a072f73e048954baa9a6c79f05654c4e801bab00f73003c2ce13537d8bd072d

    • C:\Users\Admin\AppData\Local\Temp\e52e53d01b28b219e4d73968ab622bcdaa75bbdf6d5d664c479e133041edec52.exe.exe

      Filesize

      864KB

      MD5

      36f5184e70e96529ee2273fd22e769d7

      SHA1

      0657d9d4eb0a2984ad472f2836af61f3108fef2c

      SHA256

      c6bf34306539cb5a72392a1d1299e1d90a52f3d1f074c9475732ca8354d048bf

      SHA512

      bab68dcc8f94722cec4ba4b3001754b767f8a9836f07e6aef0d6f3c82e0cd9a8aa073b4dd92df6b6039e800028fb508f97bfd8b1699c0656033245dc591aecc2

    • C:\Windows\Logo1_.exe

      Filesize

      29KB

      MD5

      e204efa82c4df71160c451caec4787e5

      SHA1

      e56ddb6d0afdb9aa1bf4808765b25cf4a2fdc279

      SHA256

      4ff7272e95a79354eb6d72c784593bd6a0820fe9e512ff176a51fef8929b5bd9

      SHA512

      6ee14cc010de5b04eee707242a6f4471739cc62bf86a332d5c0e90f15a778fe2ef1d8e1bf7f86a603cbf00fa8e302c09f533f837f5d67f62743396074ed030c9

    • F:\$RECYCLE.BIN\S-1-5-21-523280732-2327480845-3730041215-1000\_desktop.ini

      Filesize

      9B

      MD5

      475984718232cf008bb73666d834f1f4

      SHA1

      12f23c9301c222f599a279e02a811d274d0f4abc

      SHA256

      a5b32591119f87eb3c8a00c0c39e26ea6d6414aa9887d85fcb4903e1c14921b5

      SHA512

      80235dc2560b7991d79f9550cdeca6ac02c00cee6bf186f8f20d4ff3fbd7718be937b73ab768d71c4027e153557b08bbfd95ea88d2e0857a7c70cf1da6fa9937

    • memory/1432-31-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1432-37-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1432-41-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1432-24-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1432-449-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1432-1238-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1432-8-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1432-4789-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1432-5234-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1912-0-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1912-10-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB