Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
04-10-2023 19:54
General
-
Target
7f5bb2a8d65ca36733f07f0f91c91d473ab6c5d165b2d603720f4ae078e38119.exe
-
Size
4.9MB
-
MD5
f3b1afaa5caf3baf2f9f402c12490527
-
SHA1
100ca968146267b76a81c6308820c890bbb5b3a2
-
SHA256
7f5bb2a8d65ca36733f07f0f91c91d473ab6c5d165b2d603720f4ae078e38119
-
SHA512
67c5664a4d9e3e8466d0254b1ce28570e4f1bd9dad52488d096ce52ef97d3306a97ea8ed857987b835f04e2f7561224c8add9bb9c199fd3a371839726ebbe84b
-
SSDEEP
98304:lLPplQsqOb2lP8ssYoJuKklWsM0r1QnxK4zKH00FeS:NSNDto4K8UKYKDoS
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\7f5bb2a8d65ca36733f07f0f91c91d473ab6c5d165b2d603720f4ae078e38119.exe"C:\Users\Admin\AppData\Local\Temp\7f5bb2a8d65ca36733f07f0f91c91d473ab6c5d165b2d603720f4ae078e38119.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pin.exe"C:\Users\Admin\AppData\Local\Temp\pin.exe" "C:\Users\Admin\AppData\Local\Temp\7f5bb2a8d65ca36733f07f0f91c91d473ab6c5d165b2d603720f4ae078e38119.exe" 53863⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53d83ea4c8ec9b31d9ff2c82fa29beabb
SHA1d0ee9aa349ad4a47b319f691d67023e255ef81ba
SHA2564cd903859549d4b20b571041f96dfae1136ed079c476126268f9d7cc1b611150
SHA51250e3b69c79fd0c09a3cb3a70c15d1272eff48decc192a18ba0a64d5490a7ed957e97b029621a03388fce9428764d1eadab0b6b10f07feda8518aea651099cc5d
-
Filesize
1KB
MD5915042b5df33c31a6db2b37eadaa00e3
SHA15aaf48196ddd4d007a3067aa7f30303ca8e4b29c
SHA25648da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
SHA5129c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
-
Filesize
1KB
MD505240cd20679544d6e90fcff746425bc
SHA1db85a00ab8daaf90050b20b30266c92a58cb71f2
SHA25669dee148a2cc470554dfa7142e830662062394d0fe67cddd379aba90dc60d6b3
SHA5124109a4e0cfe37c1732ca099caa4bd1106c4e298a9f1dd50828cef8067435cc668dab44be7d4a4da3fbafdda5aeee22ae5c42416cf79d0996089783cb13b2ff4a
-
Filesize
1KB
MD5a12ebca0510a773644101a99a867d210
SHA10c94f137f6e0536db8cb2622a9dc84253b91b90c
SHA2566fb9754611c20f6649f68805e8c990e83261f29316e29de9e6cedae607b8634c
SHA512ae79e7a4209a451aef6b78f7b0b88170e7a22335126ac345522bf4eafe0818da5865aae1507c5dc0224ef854548c721df9a84371822f36d50cbcd97fa946eee9
-
Filesize
765B
MD582703a69f6d7411dde679954c2fd9dca
SHA1bb408e929caeb1731945b2ba54bc337edb87cc66
SHA2564ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b
SHA5123fa748e59fb3af0c5293530844faa9606d9271836489d2c8013417779d10cc180187f5e670477f9ec77d341e0ef64eab7dcfb876c6390f027bc6f869a12d0f46
-
Filesize
139B
MD5d0104f79f0b4f03bbcd3b287fa04cf8c
SHA154f9d7adf8943cb07f821435bb269eb4ba40ccc2
SHA256997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a
SHA512daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6
-
Filesize
8KB
MD5f3f8ead5440d1c311b45be065d135d90
SHA105979f0750cf5c2a17bd3aa12450849c151d8b7c
SHA256d446a8c73d7bbe4872d6524b15ae206f9a2d7eb53f8c9cb6e6c893a43acc5276
SHA512d52ead0329e9223dce3d54f83c9e8caab7974355c248e2e85a1a8aa3198af402507761c22bad31307ae3bda06528ed0b3487e9ac9f6a6c3c413e09a5acac915d
-
Filesize
19KB
MD544b878919f79e365120f1c960434870b
SHA1c8131976421b07782a1c913eb5996581a277e047
SHA256a6967e7a3c2251812dd6b3fa0265fb7b61aadc568f562a98c50c345908c6e827
SHA512e9fd65eb9e01ec40d67b558e3a4be4ae24766436ed8f60b62e75cef07f2f983b3df4d7963f23d23007acee12f151359d7d3861663348ef2b360e14a84bf3d2ee
-
Filesize
19KB
MD544b878919f79e365120f1c960434870b
SHA1c8131976421b07782a1c913eb5996581a277e047
SHA256a6967e7a3c2251812dd6b3fa0265fb7b61aadc568f562a98c50c345908c6e827
SHA512e9fd65eb9e01ec40d67b558e3a4be4ae24766436ed8f60b62e75cef07f2f983b3df4d7963f23d23007acee12f151359d7d3861663348ef2b360e14a84bf3d2ee
-
Filesize
19KB
MD544b878919f79e365120f1c960434870b
SHA1c8131976421b07782a1c913eb5996581a277e047
SHA256a6967e7a3c2251812dd6b3fa0265fb7b61aadc568f562a98c50c345908c6e827
SHA512e9fd65eb9e01ec40d67b558e3a4be4ae24766436ed8f60b62e75cef07f2f983b3df4d7963f23d23007acee12f151359d7d3861663348ef2b360e14a84bf3d2ee
-
Filesize
1KB
MD52c3ab49263bf9bf891d943ad5ddf9356
SHA17d02f07a21cc5460c55eaab71d150267370712a4
SHA256c56c64b144a12edc2b3e0301f742d66e6c6be34a31e6cac15898eb2b604276e3
SHA512b3bc7984919d71259e4495c62647e6f23b3afb1493f1076c5456abb951c9b11c766d2509795074999a3b6c62b3a7b8f36f0ea66444add2fb593ee5f2757ae139
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB