Analysis
- max time kernel
143s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20230221-en - resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2023, 14:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230221-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target file.exe
- Size 267KB
- Sample230614-rnf4esaa52
- SHA256 eef51981f7cdb215ed2578d443d27eddbed6dcaa37c568200edfc545b43ec69d
- MD5 d08a460cac4ff3eea6484336953a0d08
- SHA1 662dd7717e21aebe261d44b57842aea44c2c8939
- SHA512 c88ec4c8b5efe86fc14af8ea266986780a4a48030715ced616a1cd857667be7b0b05d4ae414495190ae3065a302b49a603d028257f923579017ab05a48a5d175
- SSDEEP 6144:PYa69YhsG4XwmevagvImdFMtRTNTpPx07s232DglOw:PYHYhs2XIvfTNNPx0rim
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation file.exe - Loads dropped DLL 1 IoCs
pid Process 1188 file.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1188 set thread context of 4556 1188 file.exe 81 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe 4556 file.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1188 file.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4556 file.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1188 wrote to memory of 4556 1188 file.exe 81 PID 1188 wrote to memory of 4556 1188 file.exe 81 PID 1188 wrote to memory of 4556 1188 file.exe 81 PID 1188 wrote to memory of 4556 1188 file.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsl9707.tmp\whuge.dll
- Size 44KB
- SHA256 2327a2e070e40aa90e3534d9acbcebfc5af17a26eeb05a4d80faec633a3dff43
- MD5 ae322cc2e6d5ef8496cb9057dee16ad1
- SHA1 29081880652818f488394bcd3b0c3030db695e67
- SHA512 ac18e87a630659d9d98e6ed03ba377e9cf74be17908a4ef9332ba20b58fbbd10fbc662871773569da56843f18c88e278d31f819d7e062a16c8fb8f994b200707
- SSDEEP 768:HjdnBBiwWLnNGHPUtOCd0D8bYaXEOTNKYWZ62Ua6WarJM:HjUXNoUsCnE6kNarJM
- MD5 SHA1 SHA512 SSDEEP