Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
24-11-2023 12:05
General
-
Target
13dc18a440d4f708541eb3b38447d4349e04300b73bb0d44d9f3fca360e64f09.exe
-
Size
667KB
-
MD5
d254d906546bb08f44fb926becd2c16b
-
SHA1
bb0a8e863bc9963d67598ff78bd9394f61291d8e
-
SHA256
13dc18a440d4f708541eb3b38447d4349e04300b73bb0d44d9f3fca360e64f09
-
SHA512
2fc7f441c88a7f1d03f65b3f22587a3ce81d4125f302171eac6ae4c2a7ef7ace4bd65142b5b9318cff55d07e43af71f8192e7fe7c86704bbfacdd5e5f628e079
-
SSDEEP
12288:P4voTsQDs7Pq+p5wPsEGw1VLw7BlhgrgUS08eZel2O6+:UoTIPq+p+jPw7Bn0gUSmZi36+
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\13dc18a440d4f708541eb3b38447d4349e04300b73bb0d44d9f3fca360e64f09.exe"C:\Users\Admin\AppData\Local\Temp\13dc18a440d4f708541eb3b38447d4349e04300b73bb0d44d9f3fca360e64f09.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\YuYagxq.exe"C:\Users\Admin\AppData\Local\Temp\YuYagxq.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
332KB
MD51479dd35eaff9251ff0fd655efb18f5a
SHA1cfd9dba1e4f68d6deacac058b1d5fe335b7744d3
SHA256f4f3a764165dbbfebae33472b938908102d59062c4dba04726f8d08d3c6fbc66
SHA512c25a16f74433fb0b437a84bf832f69acc2fdef28a526bada5cef0fa1df6314fe3c33b0d9abe018c7aef32afef2919c00aa30154cae5990d321021ec10acec31e
-
Filesize
332KB
MD51479dd35eaff9251ff0fd655efb18f5a
SHA1cfd9dba1e4f68d6deacac058b1d5fe335b7744d3
SHA256f4f3a764165dbbfebae33472b938908102d59062c4dba04726f8d08d3c6fbc66
SHA512c25a16f74433fb0b437a84bf832f69acc2fdef28a526bada5cef0fa1df6314fe3c33b0d9abe018c7aef32afef2919c00aa30154cae5990d321021ec10acec31e
-
Filesize
332KB
MD51479dd35eaff9251ff0fd655efb18f5a
SHA1cfd9dba1e4f68d6deacac058b1d5fe335b7744d3
SHA256f4f3a764165dbbfebae33472b938908102d59062c4dba04726f8d08d3c6fbc66
SHA512c25a16f74433fb0b437a84bf832f69acc2fdef28a526bada5cef0fa1df6314fe3c33b0d9abe018c7aef32afef2919c00aa30154cae5990d321021ec10acec31e
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
300KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB