Analysis
-
max time kernel
138s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
28-11-2023 12:28
General
-
Target
Wishes for our journey November 2023.scr
-
Size
643.0MB
-
MD5
211eb4f3ef90b4de98dbaf02ca4e84ea
-
SHA1
9cedbdb80bfad19a544b654c1acd1bea05100f3d
-
SHA256
3987ec9427b0cd379f15d0b47495d82fb02d0d81ff7d97c8ecb1cc89d1579855
-
SHA512
8ce12429bb100cdc4382c37a35292592129af1870f397182b2e5e071be685634d3ff7e29b347fed489190d0e64456f14c97b08be4068537266c75a3cfc60fdc5
-
SSDEEP
49152:WJM8HnE4zw7vtvw2DnXSGLZDRSh0z5+huOV0J3xoX7ixFgn:WJpzw7vdRDR54u7oy2n
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wishes for our journey November 2023.scr"C:\Users\Admin\AppData\Local\Temp\Wishes for our journey November 2023.scr" /S1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Wishes for our journey November 2023.scr" & del "C:\ProgramData\*.dll"" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
512KB
-
Filesize
4KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
16.0MB
-
Filesize
960KB
-
Filesize
972KB
-
Filesize
960KB
-
Filesize
512KB
-
Filesize
2.2MB