Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
09-06-2023 19:53
General
-
Target
644d7b2a5b77af5c208cd25183d1fd2ef5166839c2527feed817a9edf8428af1.exe
-
Size
1.8MB
-
MD5
ee9aae527b76d820d8073cfc8aadd2a6
-
SHA1
4173a59c04c8caae5d6dedef6a44eed3563fd07d
-
SHA256
644d7b2a5b77af5c208cd25183d1fd2ef5166839c2527feed817a9edf8428af1
-
SHA512
83abce43e3dc9392f80325d14aa4f8d57a6e90f6539292d28aa1c743b250df37a7a12202d3d9a5af2053141d0aadca455c4bf2249eabf1155f081ccbac8c5093
-
SSDEEP
49152:br7lvXVA25XQvTL+khaqsw7Srlvg+VenyDw5:xvXVACXQ7qkhaq97KAnyk
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\644d7b2a5b77af5c208cd25183d1fd2ef5166839c2527feed817a9edf8428af1.exe"C:\Users\Admin\AppData\Local\Temp\644d7b2a5b77af5c208cd25183d1fd2ef5166839c2527feed817a9edf8428af1.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Documents\ttd.exe"C:\Users\Public\Documents\ttd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Public\Documents\ttd.exe"C:\Users\Public\Documents\ttd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
461KB
MD54be169cd99284a3088d029dd1ea2a2e5
SHA1fc01c7e395fe7a0af5c747e24a09a903ab1d7904
SHA25656dcc8719cdc753ca10b31905f7551a99e35b658b6ecd8a9f97aca34b7c3176b
SHA5129eaf4eb4a70266469e2a2a267ebf68815f3fbbcfbb241ac3257b15d1683ec504bafe940f99542994c4b5cad3dacc52a335957b6aca4c4482a4428f3b38cf583a
-
Filesize
461KB
MD54be169cd99284a3088d029dd1ea2a2e5
SHA1fc01c7e395fe7a0af5c747e24a09a903ab1d7904
SHA25656dcc8719cdc753ca10b31905f7551a99e35b658b6ecd8a9f97aca34b7c3176b
SHA5129eaf4eb4a70266469e2a2a267ebf68815f3fbbcfbb241ac3257b15d1683ec504bafe940f99542994c4b5cad3dacc52a335957b6aca4c4482a4428f3b38cf583a
-
Filesize
461KB
MD54be169cd99284a3088d029dd1ea2a2e5
SHA1fc01c7e395fe7a0af5c747e24a09a903ab1d7904
SHA25656dcc8719cdc753ca10b31905f7551a99e35b658b6ecd8a9f97aca34b7c3176b
SHA5129eaf4eb4a70266469e2a2a267ebf68815f3fbbcfbb241ac3257b15d1683ec504bafe940f99542994c4b5cad3dacc52a335957b6aca4c4482a4428f3b38cf583a
-
Filesize
643KB
MD5dd12729cb9aa55eb4a036a6aa0cec3b9
SHA1cfe064e88f93d7b93677fd7e9d184a45758bcd5a
SHA256cfa46626de2511b8bba3ddb850768bcd531eacef7cd60daa6c6b4858278d08ac
SHA512e704b4e79530c29b2a8ee143d95d26e5a276c87a03a41e25420fb0fcb310fdce837aaa101468aa99a26543c6e11d5758c70bfc97c01296f23972b53cf437d9d9
-
Filesize
643KB
MD5dd12729cb9aa55eb4a036a6aa0cec3b9
SHA1cfe064e88f93d7b93677fd7e9d184a45758bcd5a
SHA256cfa46626de2511b8bba3ddb850768bcd531eacef7cd60daa6c6b4858278d08ac
SHA512e704b4e79530c29b2a8ee143d95d26e5a276c87a03a41e25420fb0fcb310fdce837aaa101468aa99a26543c6e11d5758c70bfc97c01296f23972b53cf437d9d9
-
Filesize
643KB
MD5dd12729cb9aa55eb4a036a6aa0cec3b9
SHA1cfe064e88f93d7b93677fd7e9d184a45758bcd5a
SHA256cfa46626de2511b8bba3ddb850768bcd531eacef7cd60daa6c6b4858278d08ac
SHA512e704b4e79530c29b2a8ee143d95d26e5a276c87a03a41e25420fb0fcb310fdce837aaa101468aa99a26543c6e11d5758c70bfc97c01296f23972b53cf437d9d9
-
Filesize
2KB
MD5e65a03587ea6b52977c0a4c1759b8b75
SHA19b04a5ec73802f7b341a770d3d5c3154b3f27067
SHA256a224a491569937752415b96382e1fe12d5c645234d058bc08255227983993d76
SHA5128a2066fc9b53d39430712dedb24701327ea82faf38857ace4fc220eafc6dbd90761b8fa0b2e70e6ca8cdcdbf3f2fc4576be824fdd915e39bc36b089510fa6f1c
-
Filesize
1020KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
236KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
408KB
-
Filesize
4.8MB
-
Filesize
264KB
-
Filesize
88KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
112KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
516KB
-
Filesize
264KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
264KB
