Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12/10/2023, 04:56
General
-
Target
67b01ab9c3348aa89160478c0c3611fa541f4ca7d3428e231dcbeee4d2aeeb4f.exe
-
Size
274KB
-
MD5
b4f4482d2a695274a0fa26b766075879
-
SHA1
96e28b50847a68b6223327d81edf2c85875f72a4
-
SHA256
67b01ab9c3348aa89160478c0c3611fa541f4ca7d3428e231dcbeee4d2aeeb4f
-
SHA512
524f80018d259a6964db4e6550ba027a05d77a2da8d5d14736710a563477701278a16a0b42e47a3c2d783b78f02b4a65ba4d01b3ecf2f39df2e40e8035fe9ebc
-
SSDEEP
6144:SbTirrfykiiUjh6QH/cEOkCybEaQRXr9HNdvOa:SPcrfR6ZnOkx2LIa
Malware Config
Signatures
-
Drops file in Drivers directory 9 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 21 IoCs
-
Drops file in Windows directory 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 59 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\67b01ab9c3348aa89160478c0c3611fa541f4ca7d3428e231dcbeee4d2aeeb4f.exe"C:\Users\Admin\AppData\Local\Temp\67b01ab9c3348aa89160478c0c3611fa541f4ca7d3428e231dcbeee4d2aeeb4f.exe"2⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\67b01ab9c3348aa89160478c0c3611fa541f4ca7d3428e231dcbeee4d2aeeb4f.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- Delays execution with timeout.exe
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5adf1b2e1e89eba448400b4d4c1c66863
SHA17cec24140330f0d5805ddd31c808ce7098fc8ae6
SHA2565662ba91c2993d12b16a4e4e90684f7407a0719666bdbc8b3665b07c630dfb7d
SHA5124f2192b20e610e50b2f17a526474768da9eec44032a3ad9f7900fc909a10aee27724e13f8bde6e4cfa96283578f4418edb997152a773859ed494ccb6e09dc09a
-
Filesize
1KB
MD5cecdfa49341ff31d9354fcf2ffa1d068
SHA16f2166ae4d4a47a653731d577b55029d4ac037ac
SHA2569fa4b6bb08ee1191afe035fb077f54b5f382fa7f19b410dc4c8a8057686c8a21
SHA5124f41e922c5ddabace2f7699eeb1ae0c6919b8825787e6a3f905af8396e0ef7b26c3cdb575d834baf55df258d03154a729a970aeeba41dd16fddb74338aeeb343
-
Filesize
599B
MD502f0a29ee61ccf6a719db3cd108d8c6f
SHA178993d8eaa19ae6ecb5614d38e3528d7d1f5f658
SHA2566470e6b7adaa270e7553e197e71ed23e280352c83c43b5c32c978f991e8111bd
SHA512e0f5b18d6350f2bf87fb54bf0ec9dbb3f08fa01c8b45a42af152b120117d4301e9e9543bbff06824b4bac7487e4ca29618dd8c46e7b5dedb663220d33929df64
-
Filesize
484B
MD5d4347bdc91cdefecbbb78130fc8275d1
SHA1a11dc53c818e24fb6511f2eacafc7ea39b5b8a8f
SHA256b3939fad78ac120fd2f202c539d557d74cb760b90428db15a01bacbd7e4e3402
SHA5124971ca83bec1ae47ef2d66ec39c8f78000f6076619605ce0747194e6dca178042fb461f46e24c4178763c7c04ed3d79fa27bc0e2f2b13062dc8ec38253be2819
-
Filesize
482B
MD56fd8ac00bdb4f13dcd28c15254b3a92b
SHA1c3825f12815f2f54a0dd2e7a5f46a033095da7d4
SHA256cd4844653e41ae67dfdf2cc2410622fedd75e7bd7b5e7930093438a0d22348ba
SHA512afc25bf5cfed3b4c6767a30632c213abdc8fcb82a13b84a0c10aac2ca9e0be770511652a55ad1ec8b342cf1042a94d0b164aa2e4d7a5ebb386afa69d9a71c8ce
-
Filesize
504B
MD595a7a6f58fc278d92bea760c1bffcb3f
SHA1b6ee25892ae86888fdceb010ea218d0ee2c92866
SHA2566bdba5ab9c57b16d8e4e7f8b4411427fdcb04090987ef602b2fb8c6a7f3c07a7
SHA512e33779b92f4e567f0eebf23f157d410219396a8fc048f8e23177f541f66b2cad1f27f5cdf653605e1847120b3fe495062bbb4ab1a108f78b4bf7ebd2db8ee4a3
-
Filesize
415KB
MD59cb06daeb033d7b6cf5f0a7ee3849c5e
SHA13fdde9ae15b82e77b4a0898b4e675cdc3cc27c09
SHA256ac05af04aa4828fa7b83781d949913ce78ea7b858d8a9020b9c7479d01f6a7c4
SHA51281f4c594d9df56f975b675fcec5cf2ac0e31a6905374de80d2e09dff427b479abfdcc76a1be5ef5ee4c2cc2a90f971712d78d3e15cf2a5cab2f2434476e58dc8
-
Filesize
447KB
MD52988f46e976afe9a45e84d0e7578958f
SHA17918988bdf593b0bd008afad01794c41b4676887
SHA256453407f10d38d3bd6b4808ea8f4d9fe423557bf37dc7cd569b3abc7dc3279bdc
SHA51271708bd6fcd79997d98410949a56780eaf375143b60e44ba9fd39544168ef577fa944d7ed001a26f25b772dd4d16c708fdd96addbf8c4efbf2b3dec472e836d6
-
Filesize
447KB
MD5d15f5f23df8036bd5089ce8d151b0e0d
SHA14066ff4d92ae189d92fcdfb8c11a82cc9db56bb2
SHA256f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520
SHA512feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9
-
Filesize
415KB
MD564bc1983743c584a9ad09dacf12792e5
SHA10f14098f523d21f11129c4df09451413ddff6d61
SHA256057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5
SHA5129ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
16KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
708KB
-
Filesize
64KB
-
Filesize
708KB
-
Filesize
4KB
-
Filesize
708KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
64KB