Analysis
-
max time kernel
123s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
11/07/2023, 07:19
General
-
Target
e7d0b1787175d9exeexeexeex.exe
-
Size
327KB
-
MD5
e7d0b1787175d9aaa4ca2da4528a67b3
-
SHA1
2c45829a9316f7568ddcf30ddf6af1e8406dac89
-
SHA256
49ce4b14fea47ab92e5ce5cd79ed55305da5b2d9aef4a5ce11fbf6ba246a2b05
-
SHA512
a5c4f1ceb21de86ae7f67feeacb3691a07a33b2849cca89b7f146cd3f4e8ca2148d40b5283e6022d42335d224d8e6d0b64f195d92b3709c809397098247a1c7c
-
SSDEEP
6144:62+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:62TFafJiHCWBWPMjVWrXK0
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7d0b1787175d9exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\e7d0b1787175d9exeexeexeex.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
327KB
MD51e12cffd9e6e332a5fb4e4c7064fb69a
SHA1cc721a1693f14aa559cd9423cd490c2288a26906
SHA256d6dfc2e2129ec3919805b085a9bbe8026b1c6cfb2bd1955cf9e740087fc6bc1c
SHA5125ae0850c6607dd563965b5a09ba47f24ad64b8c6e68c7edda38b8a71e6c562a63d4b7229a787758f75259a795901292e2c86324709b3d6aed6008f25d245f244
-
Filesize
327KB
MD51e12cffd9e6e332a5fb4e4c7064fb69a
SHA1cc721a1693f14aa559cd9423cd490c2288a26906
SHA256d6dfc2e2129ec3919805b085a9bbe8026b1c6cfb2bd1955cf9e740087fc6bc1c
SHA5125ae0850c6607dd563965b5a09ba47f24ad64b8c6e68c7edda38b8a71e6c562a63d4b7229a787758f75259a795901292e2c86324709b3d6aed6008f25d245f244
-
Filesize
327KB
MD51e12cffd9e6e332a5fb4e4c7064fb69a
SHA1cc721a1693f14aa559cd9423cd490c2288a26906
SHA256d6dfc2e2129ec3919805b085a9bbe8026b1c6cfb2bd1955cf9e740087fc6bc1c
SHA5125ae0850c6607dd563965b5a09ba47f24ad64b8c6e68c7edda38b8a71e6c562a63d4b7229a787758f75259a795901292e2c86324709b3d6aed6008f25d245f244
-
Filesize
327KB
MD51e12cffd9e6e332a5fb4e4c7064fb69a
SHA1cc721a1693f14aa559cd9423cd490c2288a26906
SHA256d6dfc2e2129ec3919805b085a9bbe8026b1c6cfb2bd1955cf9e740087fc6bc1c
SHA5125ae0850c6607dd563965b5a09ba47f24ad64b8c6e68c7edda38b8a71e6c562a63d4b7229a787758f75259a795901292e2c86324709b3d6aed6008f25d245f244