Analysis
-
max time kernel
146s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
17/07/2023, 06:22
General
-
Target
TT payment.exe
-
Size
280KB
-
MD5
0b53570dda412c985f1913d0ad097b6f
-
SHA1
69e8648f91033de6b221c969fa1804b370f9fea1
-
SHA256
00d4da9d4fbc98752b5b2d9ada463a4c5cd3ebfde5b81821525727b3c258a4de
-
SHA512
12042e8ac4ec3554c0e847c3d92114e031f6c2d526421cfa0e5373d6caeb957858f277a2f90099a14a873715fae2fa654e53bce0265b0182435ff1ebe98c5089
-
SSDEEP
6144:/Ya6R+XvLSi08M0pKNQkK/1D7oTr+xGZ/e3AaNAJpm3hAjttdNYFb2upPI:/YDqL68MNXuDaPWw9jttdFupA
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TT payment.exe"C:\Users\Admin\AppData\Local\Temp\TT payment.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT payment.exe"C:\Users\Admin\AppData\Local\Temp\TT payment.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5ca24e7e81aefb3cb413667d916a21d95
SHA1459b0078de3126776cd6969b2b7740a07aafe7d7
SHA256e25490e7846e48655bf0339f7713568f40a9f21cf5a97ebdbfc4103d131f1421
SHA5121ba52bb357cc805cf323ad50ef95ea1a4f1c9681502aebd82ef24fb1ecd4a29af88da14fc6a99c36d16b544a0950dec8d623caad9ca27d80ccd25376cef475be
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
3.3MB
-
Filesize
192KB