Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
15/05/2023, 22:06
General
-
Target
27f03bcd5cf9f3252316c1aea335f56dd9909c53832707b9f56033d1da98a0a1.exe
-
Size
1.8MB
-
MD5
7a3c047825bd8ab275ed90334619869f
-
SHA1
4fece8f6b093bd2ca357ca0ef6a0b0ef82252ead
-
SHA256
27f03bcd5cf9f3252316c1aea335f56dd9909c53832707b9f56033d1da98a0a1
-
SHA512
aba717d72f2a8d2e9f92814e1abc0564131a653b87890fc60b3305b442eac1b16196e6958a498010dccc2d3a24a82346c00bd6f78f899c3f348a90d026705a13
-
SSDEEP
24576:RhC37BlQeNxnsPbeOpbTXU8GmH7HuSpnSCFxnQYBgPazizYtTzxpTj0v/JIr:C37BxPpU98CcEOexRQW
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\27f03bcd5cf9f3252316c1aea335f56dd9909c53832707b9f56033d1da98a0a1.exe"C:\Users\Admin\AppData\Local\Temp\27f03bcd5cf9f3252316c1aea335f56dd9909c53832707b9f56033d1da98a0a1.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1280 -s 19842⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 476 -p 1280 -ip 12801⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD5fc28168b916bf9744961653d503e1164
SHA171deadab13b81a414582f931e9af010152463644
SHA256a2a78e9fb30fe365d454ca6bbbf950355049c978262fdf0e80cd683622cf00e9
SHA51208d828e18ccb2892f12dcbbaf5a5ffcafb4e2e768536fc46b3d2fce788c52b2f61058e1ef0a47e648e2308f4f1aeb8799bef9472726d2800fa9b775f401e08c9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
964KB
-
Filesize
64KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
64KB
-
Filesize
964KB
-
Filesize
64KB
-
Filesize
660KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB