Overview

overview

7

Static

static

1

5b5285698a...2b.exe

windows7-x64

6

5b5285698a...2b.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    135s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/06/2023, 07:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5b5285698aa7716546f5782e9d32aa15a77cd3272359dc6c8285fef496f4f32b.exe

  • Size

    4.6MB

  • MD5

    84f9fd99e43cbad27e55775458a886ac

  • SHA1

    acc5c2cdd64a054baf68815d5a7eb8d9f5e23ee6

  • SHA256

    5b5285698aa7716546f5782e9d32aa15a77cd3272359dc6c8285fef496f4f32b

  • SHA512

    79d5a06fe03100fe63a6deeace75acf0fb5a63a1060eedc32598338ca3cff0740df8c0f95cd2d7c94f8cfb1a02481a48343ce455ea0cc984687a82a189cb5503

  • SSDEEP

    98304:vDHU3woGRTQKYExbvaJVEbi1TbVnLc5PG7haRTtq8b/:DvqExfGhLc5PG74RJz/

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b5285698aa7716546f5782e9d32aa15a77cd3272359dc6c8285fef496f4f32b.exe
    "C:\Users\Admin\AppData\Local\Temp\5b5285698aa7716546f5782e9d32aa15a77cd3272359dc6c8285fef496f4f32b.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4352
    • C:\Users\Admin\AppData\Local\Temp\5b5285698aa7716546f5782e9d32aa15a77cd3272359dc6c8285fef496f4f32b.exe
      "C:\Users\Admin\AppData\Local\Temp\5b5285698aa7716546f5782e9d32aa15a77cd3272359dc6c8285fef496f4f32b.exe" d2f
      2⤵
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:1332

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\JTWallpaper\Config\UseVestige.ini
    Filesize

    111B

    MD5

    5ec19df8287b749b9a640a916d781da4

    SHA1

    5184c2ab0bc1f120a8311bd6c1c0d42585d4ccbd

    SHA256

    2d585b4c1d9d29ea238ce5f46c7ff74ba2ffe062c191960de3e068dd650b915e

    SHA512

    db09a055da9a4c2ff63069b506db226979bd7a4414ca3999fbe4ea55eefff452f446f6a47fdefa9a030acfc51b885efd83503237821fb8698120b26bd08a4dba

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\JTWallpaper\Config\UseVestige.ini
    Filesize

    145B

    MD5

    911e67f4203de0513937b917240e4dc4

    SHA1

    93edcd1c2a2cb2db3f914aa8a01335118f8b3b27

    SHA256

    49cd56503a2dbf23416f2cf25b6f09d1fadb0a91e75fc4b41d7fac550be697ed

    SHA512

    3bbfc9e5e2a024164f9a419e494a195a5024ad29be063f056ebaa67b089807c351ce462567b0bc7169e964d7ffef64e72d9c3903dfbd071d05c6e00fab8792f5

    Download Submit