Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
03/06/2023, 20:13
General
-
Target
47462368df6de2d5cacba41ec50a611122c81f80a80b43267ec8a521ba39defd.exe
-
Size
58KB
-
MD5
3f86cb6afbfb77e5364211eccb475aaf
-
SHA1
b8c7ad29b8656721f3d070971e209df99a72b909
-
SHA256
47462368df6de2d5cacba41ec50a611122c81f80a80b43267ec8a521ba39defd
-
SHA512
b7f929bcd63292e4c935a923cdfd50d03bffc98928ab738c7f20ce492de13111f0341d4e0610c39948dbc0057378f63ec75bd88e19a5ccc45aca008519a27cd1
-
SSDEEP
768:ewC7DvsqpL3A9wrDlmgeU1MbL1403s9Nsg/C3bhmWu7hU2:d4DnLaw3eU1MbL14fqg/YTy
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\47462368df6de2d5cacba41ec50a611122c81f80a80b43267ec8a521ba39defd.exe"C:\Users\Admin\AppData\Local\Temp\47462368df6de2d5cacba41ec50a611122c81f80a80b43267ec8a521ba39defd.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\A\RJW620230603C5XK.exe"C:\ProgramData\A\RJW620230603C5XK.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD53f86cb6afbfb77e5364211eccb475aaf
SHA1b8c7ad29b8656721f3d070971e209df99a72b909
SHA25647462368df6de2d5cacba41ec50a611122c81f80a80b43267ec8a521ba39defd
SHA512b7f929bcd63292e4c935a923cdfd50d03bffc98928ab738c7f20ce492de13111f0341d4e0610c39948dbc0057378f63ec75bd88e19a5ccc45aca008519a27cd1
-
Filesize
58KB
MD53f86cb6afbfb77e5364211eccb475aaf
SHA1b8c7ad29b8656721f3d070971e209df99a72b909
SHA25647462368df6de2d5cacba41ec50a611122c81f80a80b43267ec8a521ba39defd
SHA512b7f929bcd63292e4c935a923cdfd50d03bffc98928ab738c7f20ce492de13111f0341d4e0610c39948dbc0057378f63ec75bd88e19a5ccc45aca008519a27cd1
-
Filesize
58KB
MD53f86cb6afbfb77e5364211eccb475aaf
SHA1b8c7ad29b8656721f3d070971e209df99a72b909
SHA25647462368df6de2d5cacba41ec50a611122c81f80a80b43267ec8a521ba39defd
SHA512b7f929bcd63292e4c935a923cdfd50d03bffc98928ab738c7f20ce492de13111f0341d4e0610c39948dbc0057378f63ec75bd88e19a5ccc45aca008519a27cd1
-
Filesize
144KB
MD5a29623afa0f30b83b24ecd3b3e347b0b
SHA14ba08887adc21c05f175ee403d5122d647aac7ae
SHA256f57c5e3be5bc0d81239bd2ba39f8b3e3d4da356a6812c62d974e08d4f2c4df1b
SHA512753d1fd90a45e10dd837a8bdc5935d3a1e8ecc981e3035d09ba3d2ec7a78936d1ba6bf783f3d798bcd01421d12269cd2a6327861c15967e2982d66edefb987fb
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB