Analysis
-
max time kernel
164s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 02:11
Static task
static1
Behavioral task
behavioral1
Sample
ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe
Resource
win10v2004-20230915-en
General
-
Target
ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe
-
Size
198KB
-
MD5
2a7adc9e6476edf358ddd730961f7b38
-
SHA1
d0dbf372b11487d420887e1ec1e341f9b76f6ca8
-
SHA256
ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db
-
SHA512
ba3a7cd13da855b5e890732aee71935d21e09b7181e7d8f853c2da0dbcdbf254dda9cf14e84a7038e346d61ec912ff2edb3474fb165978115d6f73278a1f32ec
-
SSDEEP
6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCON:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXc
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe -
Executes dropped EXE 1 IoCs
pid Process 3896 dcihost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Debug\dcihost.exe ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe File opened for modification C:\Windows\Debug\dcihost.exe ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 dcihost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dcihost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3220 ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3220 wrote to memory of 912 3220 ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe 91 PID 3220 wrote to memory of 912 3220 ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe 91 PID 3220 wrote to memory of 912 3220 ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe"C:\Users\Admin\AppData\Local\Temp\ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DDFD5E~1.EXE > nul2⤵PID:912
-
-
C:\Windows\Debug\dcihost.exeC:\Windows\Debug\dcihost.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
198KB
MD5262f9b4135fd0e818340129db7f0b2cc
SHA13d188c5a89d4bbb4117f67eee4e0d64d01e44952
SHA256b277f8d64293ff27715664fe1a2afbbfc8bc324dcb2ace16b2e64def99fab9fd
SHA512eedf5f9e97ac897d0b060a1f767fb0b786d86a9d3b616e141858848952bdddbff064c214cc8860ab818242b5e24823b51c27522ef9b60e5627fe6a33fac503c6
-
Filesize
198KB
MD5262f9b4135fd0e818340129db7f0b2cc
SHA13d188c5a89d4bbb4117f67eee4e0d64d01e44952
SHA256b277f8d64293ff27715664fe1a2afbbfc8bc324dcb2ace16b2e64def99fab9fd
SHA512eedf5f9e97ac897d0b060a1f767fb0b786d86a9d3b616e141858848952bdddbff064c214cc8860ab818242b5e24823b51c27522ef9b60e5627fe6a33fac503c6