4cd684c3792c1cea5e574fa967813befc6c0ca518ab33c21bfeb7436ef40d3bb

Analysis

max time kernel
144s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

092c84f0a5edadbb5ae1f5db0570f0b2.exe
Size

268KB
MD5

092c84f0a5edadbb5ae1f5db0570f0b2
SHA1

44f9d10ad1102f8dcdb5fb250098ff385830d08b
SHA256

4cd684c3792c1cea5e574fa967813befc6c0ca518ab33c21bfeb7436ef40d3bb
SHA512

6cad81688c6ce46977ec55d9b6340cec89daf9a29612fa75ed928abe9911329c2e5243835ac2538916245bea5906cb43388562426bd749af47d7f1563cc53df5
SSDEEP

6144:pdElw6RcPnD1wRTxwGxMJcuF3ifkFmoAHSZ1C9MaZn:klgDaR6yMSuF0kFJAHw1C+6

Score

8^/10

bootkit persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{YlVJZddL-iDlr-mi2z-pXII-rN3NYVRVWHqy}\GoogleApp = "\"C:\\Users\\Admin\\AppData\\Roaming\\GoogleApp.exe\" /ActiveX"	092c84f0a5edadbb5ae1f5db0570f0b2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{YlVJZddL-iDlr-mi2z-pXII-rN3NYVRVWHqy}	092c84f0a5edadbb5ae1f5db0570f0b2.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	092c84f0a5edadbb5ae1f5db0570f0b2.exe

Executes dropped EXE 3 IoCs

pid	Process
1948	GoogleApp.exe
4404	GoogleApp.exe
2768	GoogleApp.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleApp = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleApp.exe"	092c84f0a5edadbb5ae1f5db0570f0b2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GoogleApp = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleApp.exe"	092c84f0a5edadbb5ae1f5db0570f0b2.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	GoogleApp.exe
File opened for modification	\??\PhysicalDrive0	092c84f0a5edadbb5ae1f5db0570f0b2.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 228 set thread context of 4912	228	092c84f0a5edadbb5ae1f5db0570f0b2.exe	89
PID 4912 set thread context of 404	4912	092c84f0a5edadbb5ae1f5db0570f0b2.exe	90
PID 1948 set thread context of 4404	1948	GoogleApp.exe	92
PID 4404 set thread context of 2768	4404	GoogleApp.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
228	092c84f0a5edadbb5ae1f5db0570f0b2.exe
4912	092c84f0a5edadbb5ae1f5db0570f0b2.exe
1948	GoogleApp.exe
4404	GoogleApp.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 4912	228	092c84f0a5edadbb5ae1f5db0570f0b2.exe	89
PID 228 wrote to memory of 4912	228	092c84f0a5edadbb5ae1f5db0570f0b2.exe	89
PID 228 wrote to memory of 4912	228	092c84f0a5edadbb5ae1f5db0570f0b2.exe	89
PID 228 wrote to memory of 4912	228	092c84f0a5edadbb5ae1f5db0570f0b2.exe	89
PID 228 wrote to memory of 4912	228	092c84f0a5edadbb5ae1f5db0570f0b2.exe	89
PID 228 wrote to memory of 4912	228	092c84f0a5edadbb5ae1f5db0570f0b2.exe	89
PID 228 wrote to memory of 4912	228	092c84f0a5edadbb5ae1f5db0570f0b2.exe	89
PID 228 wrote to memory of 4912	228	092c84f0a5edadbb5ae1f5db0570f0b2.exe	89
PID 4912 wrote to memory of 404	4912	092c84f0a5edadbb5ae1f5db0570f0b2.exe	90
PID 4912 wrote to memory of 404	4912	092c84f0a5edadbb5ae1f5db0570f0b2.exe	90
PID 4912 wrote to memory of 404	4912	092c84f0a5edadbb5ae1f5db0570f0b2.exe	90
PID 4912 wrote to memory of 404	4912	092c84f0a5edadbb5ae1f5db0570f0b2.exe	90
PID 4912 wrote to memory of 404	4912	092c84f0a5edadbb5ae1f5db0570f0b2.exe	90
PID 4912 wrote to memory of 404	4912	092c84f0a5edadbb5ae1f5db0570f0b2.exe	90
PID 4912 wrote to memory of 404	4912	092c84f0a5edadbb5ae1f5db0570f0b2.exe	90
PID 4912 wrote to memory of 404	4912	092c84f0a5edadbb5ae1f5db0570f0b2.exe	90
PID 4912 wrote to memory of 404	4912	092c84f0a5edadbb5ae1f5db0570f0b2.exe	90
PID 4912 wrote to memory of 404	4912	092c84f0a5edadbb5ae1f5db0570f0b2.exe	90
PID 4912 wrote to memory of 404	4912	092c84f0a5edadbb5ae1f5db0570f0b2.exe	90
PID 4912 wrote to memory of 404	4912	092c84f0a5edadbb5ae1f5db0570f0b2.exe	90
PID 4912 wrote to memory of 404	4912	092c84f0a5edadbb5ae1f5db0570f0b2.exe	90
PID 4912 wrote to memory of 404	4912	092c84f0a5edadbb5ae1f5db0570f0b2.exe	90
PID 404 wrote to memory of 1948	404	092c84f0a5edadbb5ae1f5db0570f0b2.exe	91
PID 404 wrote to memory of 1948	404	092c84f0a5edadbb5ae1f5db0570f0b2.exe	91
PID 404 wrote to memory of 1948	404	092c84f0a5edadbb5ae1f5db0570f0b2.exe	91
PID 1948 wrote to memory of 4404	1948	GoogleApp.exe	92
PID 1948 wrote to memory of 4404	1948	GoogleApp.exe	92
PID 1948 wrote to memory of 4404	1948	GoogleApp.exe	92
PID 1948 wrote to memory of 4404	1948	GoogleApp.exe	92
PID 1948 wrote to memory of 4404	1948	GoogleApp.exe	92
PID 1948 wrote to memory of 4404	1948	GoogleApp.exe	92
PID 1948 wrote to memory of 4404	1948	GoogleApp.exe	92
PID 1948 wrote to memory of 4404	1948	GoogleApp.exe	92
PID 4404 wrote to memory of 2768	4404	GoogleApp.exe	93
PID 4404 wrote to memory of 2768	4404	GoogleApp.exe	93
PID 4404 wrote to memory of 2768	4404	GoogleApp.exe	93
PID 4404 wrote to memory of 2768	4404	GoogleApp.exe	93
PID 4404 wrote to memory of 2768	4404	GoogleApp.exe	93
PID 4404 wrote to memory of 2768	4404	GoogleApp.exe	93
PID 4404 wrote to memory of 2768	4404	GoogleApp.exe	93
PID 4404 wrote to memory of 2768	4404	GoogleApp.exe	93
PID 4404 wrote to memory of 2768	4404	GoogleApp.exe	93
PID 4404 wrote to memory of 2768	4404	GoogleApp.exe	93
PID 4404 wrote to memory of 2768	4404	GoogleApp.exe	93
PID 4404 wrote to memory of 2768	4404	GoogleApp.exe	93
PID 4404 wrote to memory of 2768	4404	GoogleApp.exe	93
PID 4404 wrote to memory of 2768	4404	GoogleApp.exe	93

C:\Users\Admin\AppData\Local\Temp\092c84f0a5edadbb5ae1f5db0570f0b2.exe
"C:\Users\Admin\AppData\Local\Temp\092c84f0a5edadbb5ae1f5db0570f0b2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:228
- C:\Users\Admin\AppData\Local\Temp\092c84f0a5edadbb5ae1f5db0570f0b2.exe
  "C:\Users\Admin\AppData\Local\Temp\092c84f0a5edadbb5ae1f5db0570f0b2.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Users\Admin\AppData\Local\Temp\092c84f0a5edadbb5ae1f5db0570f0b2.exe
    "C:\Users\Admin\AppData\Local\Temp\092c84f0a5edadbb5ae1f5db0570f0b2.exe"
    3⤵
    - Modifies Installed Components in the registry
    - Checks computer location settings
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:404
  - - C:\Users\Admin\AppData\Roaming\GoogleApp.exe
      "C:\Users\Admin\AppData\Roaming\GoogleApp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1948
    - - C:\Users\Admin\AppData\Roaming\GoogleApp.exe
        
        "C:\Users\Admin\AppData\Roaming\GoogleApp.exe"
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4404
      - C:\Users\Admin\AppData\Roaming\GoogleApp.exe
        
        "C:\Users\Admin\AppData\Roaming\GoogleApp.exe"
        6⤵
        Executes dropped EXE
        
        PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\GoogleApp.exe

Filesize
268KB

MD5
092c84f0a5edadbb5ae1f5db0570f0b2

SHA1
44f9d10ad1102f8dcdb5fb250098ff385830d08b

SHA256
4cd684c3792c1cea5e574fa967813befc6c0ca518ab33c21bfeb7436ef40d3bb

SHA512
6cad81688c6ce46977ec55d9b6340cec89daf9a29612fa75ed928abe9911329c2e5243835ac2538916245bea5906cb43388562426bd749af47d7f1563cc53df5

Download Submit
C:\Users\Admin\AppData\Roaming\GoogleApp.exe

Filesize
256KB

MD5
1e04951c014c058afd4984f759562151

SHA1
be3aca6e14876473393e9f2101b95367000b482a

SHA256
dbe79bb5a2cadf5ba4b3a55dafa100f2f04c77305689b722f1f252d19a662174

SHA512
15b4a232d5a463e6e9b86904508268382446e0131e361a471ff44d21e3876bf57e3942cf0e2c221ca0d838f087bab4ca420ebba84c7a7c67f94aef1792b6b61f

Download Submit
memory/228-0-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/228-5-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/404-9-0x0000000054350000-0x0000000054379000-memory.dmp

Filesize
164KB

Download
memory/404-10-0x0000000054350000-0x0000000054379000-memory.dmp

Filesize
164KB

Download
memory/404-11-0x0000000054350000-0x0000000054379000-memory.dmp

Filesize
164KB

Download
memory/404-12-0x0000000054350000-0x0000000054379000-memory.dmp

Filesize
164KB

Download
memory/404-24-0x0000000054350000-0x0000000054379000-memory.dmp

Filesize
164KB

Download
memory/1948-25-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1948-31-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2768-46-0x0000000054350000-0x0000000054379000-memory.dmp

Filesize
164KB

Download
memory/2768-39-0x0000000054350000-0x0000000054379000-memory.dmp

Filesize
164KB

Download
memory/2768-41-0x0000000054350000-0x0000000054379000-memory.dmp

Filesize
164KB

Download
memory/4404-40-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4404-36-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4912-3-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4912-43-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4912-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads