Analysis
-
max time kernel
143s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
14-10-2023 01:55
General
-
Target
INQUIRY 020318.exe
-
Size
346KB
-
MD5
0ffecdb4854fd54be9dda9417016e658
-
SHA1
8b1053443c197b3938314fb30cf230708397dabb
-
SHA256
c8122debaede9ed9ffba560e7a8367c38801bc6879c51abaaf628a3e176cf1e1
-
SHA512
8f354ce0b53bebae40f0e82f32179ccdbe2c6ee50b10901ba52633b4c8d984b02230b4fd9b042fe95cb397673bab88b7c8075e2c323db88ae1a16ce0812cc121
-
SSDEEP
6144:JYa6oArDe5J9j8o36Lx54OANvTb9wMQPwi/8p66XNekUiDO4Gv:JYmAYt3sx2inoi0rXNe/i64Gv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY 020318.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY 020318.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zxyrcvr.exe"C:\Users\Admin\AppData\Local\Temp\zxyrcvr.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zxyrcvr.exe"C:\Users\Admin\AppData\Local\Temp\zxyrcvr.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD59e6837fd3f391f0de77d6eb547ae6519
SHA1ed263abb31e5564d56a6ee0f906a181aa4e0214d
SHA25672f6b8017904e2f0cd22edf3c3d4b9a2391ac6eff86e23e12fd51c4044213995
SHA512cd0a489925348cc8183ff07fa968437a547a4a9fe89cb5a57e422d538ac82a55ee6bf9b4a8111e0341ced3fe1db071b1ba3aa421728c0fdded484f698fc746d5
-
Filesize
166KB
MD5673a624938c204bfd3cf24f52d5c31b8
SHA1911fbc951ea7fad146cc8d693ac2c5f24a113811
SHA256ca010661d72f414fbe29b4d1582e7981d83c9d5139b5756578ec6c7e5f94201e
SHA5128d9bc0be21d44dcecd8f348d71910d106d8022420ccf2a042bb3dc5de4b1e37f0b67547a5174963b188e81ce0d1af2670f0ce230f732b692d6f0d62bdde0619b
-
Filesize
166KB
MD5673a624938c204bfd3cf24f52d5c31b8
SHA1911fbc951ea7fad146cc8d693ac2c5f24a113811
SHA256ca010661d72f414fbe29b4d1582e7981d83c9d5139b5756578ec6c7e5f94201e
SHA5128d9bc0be21d44dcecd8f348d71910d106d8022420ccf2a042bb3dc5de4b1e37f0b67547a5174963b188e81ce0d1af2670f0ce230f732b692d6f0d62bdde0619b
-
Filesize
166KB
MD5673a624938c204bfd3cf24f52d5c31b8
SHA1911fbc951ea7fad146cc8d693ac2c5f24a113811
SHA256ca010661d72f414fbe29b4d1582e7981d83c9d5139b5756578ec6c7e5f94201e
SHA5128d9bc0be21d44dcecd8f348d71910d106d8022420ccf2a042bb3dc5de4b1e37f0b67547a5174963b188e81ce0d1af2670f0ce230f732b692d6f0d62bdde0619b
-
Filesize
166KB
MD5673a624938c204bfd3cf24f52d5c31b8
SHA1911fbc951ea7fad146cc8d693ac2c5f24a113811
SHA256ca010661d72f414fbe29b4d1582e7981d83c9d5139b5756578ec6c7e5f94201e
SHA5128d9bc0be21d44dcecd8f348d71910d106d8022420ccf2a042bb3dc5de4b1e37f0b67547a5174963b188e81ce0d1af2670f0ce230f732b692d6f0d62bdde0619b
-
Filesize
166KB
MD5673a624938c204bfd3cf24f52d5c31b8
SHA1911fbc951ea7fad146cc8d693ac2c5f24a113811
SHA256ca010661d72f414fbe29b4d1582e7981d83c9d5139b5756578ec6c7e5f94201e
SHA5128d9bc0be21d44dcecd8f348d71910d106d8022420ccf2a042bb3dc5de4b1e37f0b67547a5174963b188e81ce0d1af2670f0ce230f732b692d6f0d62bdde0619b
-
Filesize
8KB
-
Filesize
212KB
-
Filesize
3.0MB
-
Filesize
212KB