Analysis

  • max time kernel
    125s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-11-2024 21:14

General

  • Target

    3987f0815c1db6dbcb4b03a9bcdb2350a25178f7e7942dcc4a0fc6f0da1dacc7.exe

  • Size

    69KB

  • MD5

    2b6f4b3339f021aca6c7293eabd7bc8e

  • SHA1

    ce121199f23bd4dffbeb1d5a9df39c33a6991d05

  • SHA256

    3987f0815c1db6dbcb4b03a9bcdb2350a25178f7e7942dcc4a0fc6f0da1dacc7

  • SHA512

    57cb72b8c96e9def049ae689447355d7234fe6faca5bc11a62b70e74f3fa45e8b4a73f5cb25d90caee1e81ae72a125a2802b566756767d3cd2e68a06e3fe61af

  • SSDEEP

    1536:rAlWyGTYr+zEexLh9ixAFibDvmtkxHmsIY:py2lFX8bDetkxHDR

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3987f0815c1db6dbcb4b03a9bcdb2350a25178f7e7942dcc4a0fc6f0da1dacc7.exe
    "C:\Users\Admin\AppData\Local\Temp\3987f0815c1db6dbcb4b03a9bcdb2350a25178f7e7942dcc4a0fc6f0da1dacc7.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\WinGuido\GuidoAusili\GAStart.exe
      "C:\WinGuido\GuidoAusili\GAStart.exe" GASTARTCOUNT1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\WinGuido\GuidoAusili\GuidoAusili.exe
        "C:\WinGuido\GuidoAusili\GuidoAusili.exe" DASTART GASTARTCOUNT1 GASTARTCOUNT1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2776
        • C:\WinGuido\GuidoAusili\GAStart.exe
          "C:\WinGuido\GuidoAusili\GAStart.exe" GASTARTCOUNT1 GASTARTCOUNT1 GASTARTCOUNT2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1912
          • C:\WinGuido\GuidoAusili\GuidoAusili.exe
            "C:\WinGuido\GuidoAusili\GuidoAusili.exe" DASTART GASTARTCOUNT2 GASTARTCOUNT1 GASTARTCOUNT1 GASTARTCOUNT2
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Checks SCSI registry key(s)
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2008
            • C:\Windows\SysWOW64\taskkill.exe
              "C:\Windows\System32\taskkill.exe" /F /IM explorer.exe
              6⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1964
            • C:\WinGuido\GuidoAusili\GAStart.exe
              "C:\WinGuido\GuidoAusili\GAStart.exe" CHECK GASTARTCOUNT3
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2648
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath ""C:\WinGuido\GuidoAusili"""
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1856
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath ""C:\WinGuido\"""
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2972
            • C:\WinGuido\GuidoAusili\GABack.exe
              "C:\WinGuido\GuidoAusili\GABack.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2864
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
    1⤵
      PID:680
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
      1⤵
      • System Location Discovery: System Language Discovery
      PID:1520

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6X0ZELMMYCOQZA6RMQZ0.temp

      Filesize

      7KB

      MD5

      c96728978e74dd101c5c098390210368

      SHA1

      55579f5f867ee20661e68541bd104ee19d61b7ff

      SHA256

      2912b29976e224d8ebefb016e8c4b5a76842de9d1b3a0acdefadeab0635f0020

      SHA512

      f0e0e026384aee7a7471ece3e238d9d7b0e5154a1c7f043de9af25d735acb7799e89323dd4c8117fc1c2930f5b9199c5abfab082eaba3dceab97f872fdd0e875

    • C:\WinGuido\GuidoAusili\ALVAW32.DLL

      Filesize

      124KB

      MD5

      d3049bfab186cd87c5e25c041a2e39e5

      SHA1

      eb136d8fb0488878d6646eea3d65ce62cd5eb668

      SHA256

      8bdbea0849298df7842c1a5cd92b500d10e94306322ea52eaa1f98ed40516638

      SHA512

      05378a294e5a29def2b0f11983d9a0b30de58fd4897065de654528ffd59822e5c279bd0557e478bb404a19c41a4fc9443b557030231a8b5934af77a180ab229b

    • C:\WinGuido\GuidoAusili\Dati\0\Stringhe\Stringhe.ldb

      Filesize

      128B

      MD5

      421b955e72f1209acce8ba371a1f4387

      SHA1

      e08a2c5935224dc011cb281b863021f08e5af499

      SHA256

      9335d0dade8f0f25d187edcd69bd5224641b4366b89346e2ec93b8761eb4d5df

      SHA512

      e236431b93eabbba33e9862352ee713c4082e62fae6042e8e4ca0c703679b96bed5feb8c92ca09fc4d383f09043bca2c8af82d46dc1d5ee5ee9de654dc21fc2e

    • C:\WinGuido\GuidoAusili\GAAgenda.dll

      Filesize

      161KB

      MD5

      acdba8c5d8662aba0145c46f6f5c839a

      SHA1

      857668c82e9235f081b777964068053562c15399

      SHA256

      644b40f1191fc88889ddafe2b286e0f74c647b94d1e98d1799de81c6eebb9ece

      SHA512

      899d9bba82d412a12906d9e518192159039e31be887301ad678ad21ce35ddbc2b027dd24db79abb9c64c3d839c9ffd9828ea675208ec6ed7135ddbb974b9d152

    • C:\WinGuido\GuidoAusili\GABack.exe

      Filesize

      23KB

      MD5

      a2e0cc453f3f9b0eda6fec6051121995

      SHA1

      c9cfe8f2dc243df4dbd8aefe7d325af28fd03dd6

      SHA256

      d40f06f1dd15ee7f18e8af277d09326c36667b03916f2548e899a8b57e6bbffe

      SHA512

      1464410bee02d4798d4167ebc57fd1a98baaeb3cbff8a50babd348fa128c9315d5798e740ec61b83a1db49b0642c134a55dd86a81553a892b079b8dec2fd0e2c

    • C:\WinGuido\GuidoAusili\GAChat.dll

      Filesize

      439KB

      MD5

      8ba5872919caa6c2812e7881f1d18414

      SHA1

      acc4c455452d67170d6b89e572cfdb1e098b9a85

      SHA256

      eb745145c55cb5d3b6d1ba17a2dbfd9ceeda3125c211dbd90773277e1f24bf49

      SHA512

      6b571fce97e2fd26ab7cf223ebe8d56f557863c45228f4e26002c7e8ee77eabae3a2debd138673e5307391333e65180d748bff20939ec8271c2c8924cf78d50c

    • C:\WinGuido\GuidoAusili\GAOCX.dll

      Filesize

      2.1MB

      MD5

      590afabdd9574b338516934d48ed9668

      SHA1

      05ea3c1c1131f7a898e7c6345c9dee3dfd37d8b4

      SHA256

      c1879a9d03a82e61e7741fcd737312b19d266fec9d7257b086ee5de499bbb726

      SHA512

      0d55966f07c90e445c18d43dcaf7736e9e84e3f566313b321689ff65f8288591552c176f857c7dae2b1fc2b5ad9e92aafc3c9c55194a520c63f903eef8c7e2cb

    • C:\WinGuido\GuidoAusili\GAPrincipale.dll

      Filesize

      191KB

      MD5

      e6e4f87c1828e67d5c5bcf778f1ad70e

      SHA1

      004ce674fb7ba50d2a3fa8fd600ffa7020150879

      SHA256

      37da3f7d024777426bbc5ccd882cadd0050c6296f513023b9f3c91a946d0c1b3

      SHA512

      e6eb06efcafd78d0ce9743a3ff001e9c0ed9b5057ffd313a38828315b94e8d440441ddb6d32fc55988e33f0f76480ec72d26f6fc66307a115ad0ac0c8164ffb5

    • C:\WinGuido\GuidoAusili\GAStart.exe

      Filesize

      28KB

      MD5

      177b1771a219d51bae8f6af2302ec2f0

      SHA1

      94a63a825ffde6f0162c5bf284fa7e87c118dbac

      SHA256

      8809840e6781e023dd8f7b725236780cf824690ca89301e4ef8b2d17e1297031

      SHA512

      c49b0b643e684bb0bad07ae8b395f6beaa1b0bcedcff16eeccccafe934da922cd710ae7bb45cafaea1a1ff891de57983cd6e52395b20b120527d97296d539a9b

    • C:\WinGuido\GuidoAusili\GuidoAusili.Log

      Filesize

      60B

      MD5

      7e33d6ac39f2d6f868c95413ec83d5f2

      SHA1

      cfe393d6ce16e73c3f2b43d36c295b0885863b77

      SHA256

      a712a3877e28a1d56f3a1b8d23213882e77d99a4cdf4f70b8b419e6422a53ecd

      SHA512

      cb33b02ab5e598679ce7889fb57260fe5d4df7004b97161330fb66c3b6593cfb6b164776d1a5330ecbc3cb0f95e52c99922189ed59ba659fe7252c23186f5b07

    • C:\WinGuido\GuidoAusili\New\GuidoAusili.exe.config

      Filesize

      4KB

      MD5

      5abf0e7c37e411a9dab0813df83b4158

      SHA1

      60ed29c7a91d54c4edbdfb4b957e91661abd9cd5

      SHA256

      d4385462ab483a473d84c563762ebd688b6fb53f10e9ad3f62d3c6199b3ea455

      SHA512

      cc8e28c13bdb7e56371963937c48b593cfaefcbf1a0c8b3f7ddc2696013312afbf34909fe6c1b88702c44f42cd9dd361f226c15e0c6b69cb2be743c08399f618

    • C:\WinGuido\GuidoAusili\New\GuidoAusili.vshost.exe

      Filesize

      23KB

      MD5

      dbd8bc6438e1011ca1b796c7a9c78d78

      SHA1

      9184d63d8335efecf3ea02845fd1f027e7edaa0a

      SHA256

      280fdcaf69c8f7145446c8bc342fa4a0c7ff0abfed111c5f72b520f479fde785

      SHA512

      1536aa27db27c9ad52c4f5fcd5acd584a520afeb2bb30aaeca03682b3737fa7820fe0eb1d7a2e0951202e5383287edf8539b0939d2587a741729ab19c8f281f3

    • C:\WinGuido\GuidoAusili\New\GuidoAusili.vshost.exe.config

      Filesize

      1KB

      MD5

      1ed5cc20071980ddc2f081af4d3be0a5

      SHA1

      548d12c8abf3a0b696487087fc2b370f52de455d

      SHA256

      18eac85da718d515287d97da93589d03acd793843b6256d27701992c66c8cc13

      SHA512

      57178babb9a98139e2954fcc9db0cf5b8b8871bb00747a9f3c827c0ed9293abe1c09a359575a3f28e2c2f8d092c808434640f01402bcca489d3916cb1b291495

    • C:\WinGuido\GuidoAusili\SLABHIDDevice.dll

      Filesize

      108KB

      MD5

      bf7c061d396c1399ec1446540d5221cc

      SHA1

      d5f356cd39d09ab737ab255f82e0e0c24ba891a0

      SHA256

      eb245fff873becd30b79260cac031d1c58bf93c6e7aa5a76d6bfac6cd1bcb411

      SHA512

      acdb828afabc41d54e5fed2737381b1ffd365783c293ba2a9cd0c3f8c41a6b537fee3e1d02c06a0513475570a313ce923bfb76e0b6f5fd46ecdea44a991e66e6

    • C:\WinGuido\GuidoAusili\SLABHIDtoUART.dll

      Filesize

      80KB

      MD5

      acf8a82427e1a19c15c0cc8ecf02d22c

      SHA1

      e1c5dcf600940dc5f418865b55a42a6b3c33d91c

      SHA256

      2226d189eed45887409670dbcfbfe5dc7f64b380f67e566123133166a4ac9754

      SHA512

      35df4a06036db2e4f49366852d193d31ee7d90ddd79c8c5f6723577674e7edb1f8046b15235d126f51baa33135f7fc4c6c76745a1ce70a848b41c275dc9f67f7

    • C:\WinGuido\GuidoAusili\Suoni\GAAttesa.wav

      Filesize

      236KB

      MD5

      b92eff9243f63eec5fb5675b30a0f324

      SHA1

      6b2a4b228c161bb92785e0e5a47f5bc9db2af44e

      SHA256

      356f6361960ad64834f87341aa3d14cde392e5ca6548ef906ecea01591d71cac

      SHA512

      aa66c5e9686dc146499fcb8277ca86c8058fd9f2c03ca2700aef8a12d960cd3dca92a8e0c1b0165e3e508c7fc7848900b40ecbb11a9a495909ba88b0e0179097

    • \WinGuido\GuidoAusili\GuidoAusili.exe

      Filesize

      69KB

      MD5

      65649c35f341359276e5a284146a4d4e

      SHA1

      4392be1b7fb3cf6ea46e12f025cc0af00b12e49d

      SHA256

      c1534cc27b181b0c684daaa68ee12d418af940d5aa3b1b181d734e4e64a7358d

      SHA512

      ce24442fff5f962e1745043b87a89f6869ee8584f641aec2b62e989460668ed9017a8054ade36df6f83f2ec9d39fa10ac7fce4dbde551c086fff7676775e00aa

    • \WinGuido\GuidoAusili\SeikaDevice.dll

      Filesize

      23KB

      MD5

      563247eb3b6d2000b27cfaefe76d7393

      SHA1

      74460b9ccde7358dd50e6738009ebc67ad4dcc54

      SHA256

      8b8fbc194d4fad9454fd1c67dc9ce1374eb1027d4e22456577baa1e0f489d068

      SHA512

      da5ffc901dc4f267cdf53f912db5aab0707c56fc1e6eb86f73ecc94b99babfbc9fddff97827b9c0b860d7d40a320374b764aade4b794fd01b7d891ff5b66b85e

    • \WinGuido\GuidoAusili\lilli.dll

      Filesize

      51KB

      MD5

      1734919e44bc6924d99b3dc03d6afbcb

      SHA1

      77147382584151a0676b67ca47f4b27c022d2080

      SHA256

      9ced3f4811e31d71f12ebc72f94f046ef1f6fe9a15785ecc1b6635355cdec637

      SHA512

      ad7675206b7c00ab0ecd55d70b2039d7c22da4738fc111988ed8ec0546881bcc47066a400dc627846795d00bc394b2f1e59ad6c09ca6727b6102d4c4e65fc5e9

    • \WinGuido\GuidoAusili\wg~eci.dll

      Filesize

      304KB

      MD5

      0fbd8fdcc7bc662e4a9c8d57a9910170

      SHA1

      0a9ce715771a5b67ab4e2a70409195fd0f9dcd1d

      SHA256

      d6cd7483f0613d84466ee23aece16d872a065dc1ae61471f788fb7eaab97972d

      SHA512

      da3a5bdf1f7b96e1cd327acde2ac9deb43ad2cd904776e91c8e9d65460ebbce8d00a022f8e64ffcaa3ba0df82302fe1cfd6d92cefec04c3f8721b428d0631f77

    • memory/1844-36-0x0000000074770000-0x0000000074E5E000-memory.dmp

      Filesize

      6.9MB

    • memory/1844-16-0x0000000074770000-0x0000000074E5E000-memory.dmp

      Filesize

      6.9MB

    • memory/1844-18-0x0000000000010000-0x000000000001E000-memory.dmp

      Filesize

      56KB

    • memory/1844-19-0x0000000074770000-0x0000000074E5E000-memory.dmp

      Filesize

      6.9MB

    • memory/1912-57-0x00000000009A0000-0x00000000009AE000-memory.dmp

      Filesize

      56KB

    • memory/2008-153-0x0000000005A40000-0x0000000005A61000-memory.dmp

      Filesize

      132KB

    • memory/2008-189-0x0000000005A00000-0x0000000005A36000-memory.dmp

      Filesize

      216KB

    • memory/2008-214-0x00000000053F0000-0x0000000005403000-memory.dmp

      Filesize

      76KB

    • memory/2008-137-0x00000000059A0000-0x00000000059C0000-memory.dmp

      Filesize

      128KB

    • memory/2008-145-0x0000000008C60000-0x0000000008CC2000-memory.dmp

      Filesize

      392KB

    • memory/2008-111-0x00000000053F0000-0x0000000005403000-memory.dmp

      Filesize

      76KB

    • memory/2008-77-0x0000000006350000-0x0000000006566000-memory.dmp

      Filesize

      2.1MB

    • memory/2008-132-0x00000000053F0000-0x0000000005403000-memory.dmp

      Filesize

      76KB

    • memory/2008-172-0x0000000005C60000-0x0000000005C75000-memory.dmp

      Filesize

      84KB

    • memory/2008-69-0x0000000000AA0000-0x0000000000AB6000-memory.dmp

      Filesize

      88KB

    • memory/2008-176-0x0000000005EA0000-0x0000000005EBC000-memory.dmp

      Filesize

      112KB

    • memory/2096-17-0x0000000074770000-0x0000000074E5E000-memory.dmp

      Filesize

      6.9MB

    • memory/2096-0-0x000000007477E000-0x000000007477F000-memory.dmp

      Filesize

      4KB

    • memory/2096-3-0x0000000074770000-0x0000000074E5E000-memory.dmp

      Filesize

      6.9MB

    • memory/2096-1-0x0000000000870000-0x0000000000886000-memory.dmp

      Filesize

      88KB

    • memory/2648-74-0x0000000000B00000-0x0000000000B0E000-memory.dmp

      Filesize

      56KB

    • memory/2776-34-0x0000000000060000-0x0000000000076000-memory.dmp

      Filesize

      88KB

    • memory/2864-131-0x0000000001320000-0x000000000132C000-memory.dmp

      Filesize

      48KB