Analysis
-
max time kernel
163s -
max time network
153s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 17:49
Static task
static1
Behavioral task
behavioral1
Sample
e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe
Resource
win7-en-20211208
0 signatures
0 seconds
General
-
Target
e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe
-
Size
2.7MB
-
MD5
dd17e8305bc0be4c9d05579e1305c6b4
-
SHA1
9d6416c6e9536ff522c435e9b7e7be417d570b4d
-
SHA256
e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c
-
SHA512
5bada9396df7381d511d0843ba744a15db02f1142166f184db2fcdd7dae384ffbf299c2735a7f358daa4a8f79ede6ce33cfa19a81a289278f6b5eb72cda8126d
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International\Geo\Nation e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exedescription ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall" e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exee300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exepid Process 3620 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe 3620 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe 3620 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe 3620 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe 3620 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe 3620 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe 4188 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe 4188 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe 4188 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe 4188 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exee300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exedescription pid Process Token: SeDebugPrivilege 3620 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe Token: SeTakeOwnershipPrivilege 4188 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe Token: SeTcbPrivilege 4188 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe Token: SeTcbPrivilege 4188 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exee300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exepid Process 3620 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe 3620 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe 3620 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe 3620 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe 4188 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe 4188 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe 4188 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe 4188 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe"C:\Users\Admin\AppData\Local\Temp\e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exeC:\Users\Admin\AppData\Local\Temp\e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe -second2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4188
-