Analysis
-
max time kernel
137s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
15-11-2023 01:45
General
-
Target
bb2fade036498ba0e6395455d03dd48e43af81e9e312dd74cc85381d527a9dcc.exe
-
Size
6.0MB
-
MD5
3d234ed54d07f7ae9262a24e440fbd34
-
SHA1
dfcd634bd95553bc613155c128232ae4c537806b
-
SHA256
bb2fade036498ba0e6395455d03dd48e43af81e9e312dd74cc85381d527a9dcc
-
SHA512
19702f024e9444013e6398bdf1bcc09d5bed20d1857da5a88562e2b076f46981f51bb8abcd62fa2fd4b0b6c793f55f9ff7e49c577ad86979306314eb9bb9df8a
-
SSDEEP
98304:HXHxb54Q/Alj3U1cB27OgUWZHwtJcJBAUZLyR8:YR3P2sWjJVO8
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 45 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb2fade036498ba0e6395455d03dd48e43af81e9e312dd74cc85381d527a9dcc.exe"C:\Users\Admin\AppData\Local\Temp\bb2fade036498ba0e6395455d03dd48e43af81e9e312dd74cc85381d527a9dcc.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\΢¹Ü¼ÒÖ±²¥ÖúÊÖ¸üаü.exe"C:\Users\Admin\Desktop\΢¹Ü¼ÒÖ±²¥ÖúÊÖ¸üаü.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 17362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 216 -ip 2161⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5ef48d7cc52338513cc0ce843c5e3916b
SHA120965d86b7b358edf8b5d819302fa7e0e6159c18
SHA256835bfef980ad0cedf10d8ade0cf5671d9f56062f2b22d0a0547b07772ceb25a8
SHA512fd4602bd487eaad5febb5b3e9d8fe75f4190d1e44e538e7ae2d2129087f35b72b254c85d7335a81854aa2bdb4f0f2fa22e02a892ee23ac57b78cdd03a79259b9
-
Filesize
6.7MB
MD5c41a6933a79058117632be3812f75c25
SHA1620848fa1bfd4cb849c6453843e7d723c801c840
SHA256ce5c0cff8ac9ebc41c3dbd5d47349397c66e3d4834cb721ef83d34eeb0e18da9
SHA512efd95190622c849afd0d1f7e2e61ede566a8e95fd4ea40f3d5f15cd5d9e0fc3a7dfc4f1773497978276eab61f8ac227a680893cb3e59fee282cf27cfe7deb2bf
-
Filesize
6.7MB
MD5c41a6933a79058117632be3812f75c25
SHA1620848fa1bfd4cb849c6453843e7d723c801c840
SHA256ce5c0cff8ac9ebc41c3dbd5d47349397c66e3d4834cb721ef83d34eeb0e18da9
SHA512efd95190622c849afd0d1f7e2e61ede566a8e95fd4ea40f3d5f15cd5d9e0fc3a7dfc4f1773497978276eab61f8ac227a680893cb3e59fee282cf27cfe7deb2bf
-
Filesize
6.7MB
MD5c41a6933a79058117632be3812f75c25
SHA1620848fa1bfd4cb849c6453843e7d723c801c840
SHA256ce5c0cff8ac9ebc41c3dbd5d47349397c66e3d4834cb721ef83d34eeb0e18da9
SHA512efd95190622c849afd0d1f7e2e61ede566a8e95fd4ea40f3d5f15cd5d9e0fc3a7dfc4f1773497978276eab61f8ac227a680893cb3e59fee282cf27cfe7deb2bf
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
44KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.4MB
-
Filesize
248KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.4MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
7.0MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB