Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
23-11-2023 22:15
General
-
Target
tmp.exe
-
Size
322KB
-
MD5
a4212217a2e90127cf2870215d72edf5
-
SHA1
2fc4ad01c10a37cc88e0c7ac02fed8734c0aa6e7
-
SHA256
6ad9ac5ab7a0071a789065d1fe2fde732d88be8faaf4e875e3097157bee34d38
-
SHA512
21c11298113f5a95dc675cfa6c935ba6be26a83f19c34c5e85ede2540fe611f6138200c2376caa00ce301d5b540d1df4339a457ff3963beb5899d8854208cd01
-
SSDEEP
6144:jSt2tu6b3Ulc6Bxz/Bn8ETaWASeIN8Sez8cihLtKb4XM1gvKUdFebAXmCEctjlLK:O36b3wcYxTBVcSeIWSeYXBKb48MJnBdK
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA2E7.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\AdobeReader\GeforceUpdater.exe"C:\ProgramData\AdobeReader\GeforceUpdater.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "MicrosoftEdgeUpdateTaskMachineCoreCor" /tr "C:\ProgramData\AdobeReader\GeforceUpdater.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "MicrosoftEdgeUpdateTaskMachineCoreCor" /tr "C:\ProgramData\AdobeReader\GeforceUpdater.exe"5⤵
- Creates scheduled task(s)
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
322KB
MD5a4212217a2e90127cf2870215d72edf5
SHA12fc4ad01c10a37cc88e0c7ac02fed8734c0aa6e7
SHA2566ad9ac5ab7a0071a789065d1fe2fde732d88be8faaf4e875e3097157bee34d38
SHA51221c11298113f5a95dc675cfa6c935ba6be26a83f19c34c5e85ede2540fe611f6138200c2376caa00ce301d5b540d1df4339a457ff3963beb5899d8854208cd01
-
Filesize
322KB
MD5a4212217a2e90127cf2870215d72edf5
SHA12fc4ad01c10a37cc88e0c7ac02fed8734c0aa6e7
SHA2566ad9ac5ab7a0071a789065d1fe2fde732d88be8faaf4e875e3097157bee34d38
SHA51221c11298113f5a95dc675cfa6c935ba6be26a83f19c34c5e85ede2540fe611f6138200c2376caa00ce301d5b540d1df4339a457ff3963beb5899d8854208cd01
-
Filesize
154B
MD5edbf1d97b9b09b36d5c61a846624dd59
SHA15bea6718e1b5cfe35d2187d5d08690708f96158e
SHA2561084249908e44a95e80a44ef85d796f3e815bf142d83bd4eefd9853fcacf0533
SHA512c87f6d7cab8f3216b6cf5c9bccaf9f11b3e02b34eceba5fa28f61f571295520c145b6f56324b4b6fb07a151def134ccdfc647a46ab0009c1bb9e36bffa8129cd
-
Filesize
1.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
256KB
-
Filesize
864KB
-
Filesize
340KB
-
Filesize
680KB
-
Filesize
3.3MB
-
Filesize
820KB
-
Filesize
404KB
-
Filesize
1.2MB
-
Filesize
632KB
-
Filesize
688KB
-
Filesize
172KB
-
Filesize
1.6MB
-
Filesize
628KB
-
Filesize
2.8MB
-
Filesize
236KB
-
Filesize
212KB
-
Filesize
156KB
-
Filesize
428KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
1.3MB
-
Filesize
864KB
-
Filesize
172KB
-
Filesize
10.8MB
-
Filesize
1.6MB
-
Filesize
756KB
-
Filesize
72KB
-
Filesize
256KB
-
Filesize
680KB
-
Filesize
256KB
-
Filesize
632KB
-
Filesize
864KB
-
Filesize
756KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
10.8MB
-
Filesize
428KB
-
Filesize
156KB
-
Filesize
1.3MB
-
Filesize
632KB
-
Filesize
756KB
-
Filesize
88KB
-
Filesize
10.8MB
-
Filesize
40KB
-
Filesize
340KB
-
Filesize
680KB
-
Filesize
3.3MB
-
Filesize
404KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
680KB
-
Filesize
632KB
-
Filesize
172KB
-
Filesize
1.6MB
-
Filesize
688KB
-
Filesize
2.0MB
-
Filesize
428KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
10.8MB
-
Filesize
1.3MB
-
Filesize
864KB
-
Filesize
172KB
-
Filesize
256KB
-
Filesize
1.6MB
-
Filesize
2.8MB
-
Filesize
72KB