e59e1c288a445ddde1bd826470bd262b5d351ba83ea9d82ad8329157e3fcc37e

Analysis

max time kernel
0s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0df9635533f46079ded4e2f41aa75180.exe
Size

552KB
MD5

0df9635533f46079ded4e2f41aa75180
SHA1

e84dc00c265fd2596160d92db35afcabb9fd721c
SHA256

e59e1c288a445ddde1bd826470bd262b5d351ba83ea9d82ad8329157e3fcc37e
SHA512

eb4d28951fd98cd4713461beddd1ab1a44e2abefb11a29deea2d1977fbdaabc4b1b1a6b5d1bd5091a37d1ec8002f331797d348ea19a6594097f599bc08dd2f67
SSDEEP

12288:tPHFsiMMnMMMMMG7ydZOtY+KVb4zgR3Qt3Q3CX1LA6T:tNsiMMnMMMMMG7EZ2Y1Vb4zr4g1VT

Score

8^/10

evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	0df9635533f46079ded4e2f41aa75180.exe

Executes dropped EXE 1 IoCs

pid	Process
1460	iCEyocHtffAu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iCEyocHtffAu = "C:\\ProgramData\\iCEyocHtffAu.exe"	0df9635533f46079ded4e2f41aa75180.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Download	0df9635533f46079ded4e2f41aa75180.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	0df9635533f46079ded4e2f41aa75180.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3220	0df9635533f46079ded4e2f41aa75180.exe
3220	0df9635533f46079ded4e2f41aa75180.exe
3220	0df9635533f46079ded4e2f41aa75180.exe
3220	0df9635533f46079ded4e2f41aa75180.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 1460	3220	0df9635533f46079ded4e2f41aa75180.exe	22
PID 3220 wrote to memory of 1460	3220	0df9635533f46079ded4e2f41aa75180.exe	22
PID 3220 wrote to memory of 1460	3220	0df9635533f46079ded4e2f41aa75180.exe	22

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	0df9635533f46079ded4e2f41aa75180.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	0df9635533f46079ded4e2f41aa75180.exe

C:\Users\Admin\AppData\Local\Temp\0df9635533f46079ded4e2f41aa75180.exe
"C:\Users\Admin\AppData\Local\Temp\0df9635533f46079ded4e2f41aa75180.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3220
- C:\ProgramData\iCEyocHtffAu.exe
  "C:\ProgramData\iCEyocHtffAu.exe"
  2⤵
  - Executes dropped EXE
  PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\iCEyocHtffAu.exe

Filesize
5KB

MD5
6c0a3b08efe1bbf8f8a85c77cd57c6f5

SHA1
1b02dbf475c0811caa35f4f28a7b1785f5563407

SHA256
022e2721c247bc39d74230f8aefb9d74c336d976a44da0793fc29511a1c38e71

SHA512
0c45a0a8e57ac57dbc7e29796e060e387ed0698f2c9b9bf447e957285079250382e5b963d19579ef5bb47f5ed6fbc14c7e5ebf2d37c3e84664a21fe2ae98c91a

Download Submit
C:\ProgramData\iCEyocHtffAu.exe

Filesize
9KB

MD5
0de6427ccccc07a86603513072d136e1

SHA1
f4a00dff97450c7489ac71271927dbc969571a3f

SHA256
93d7c99c36fafcfd22be65188c24cb020eadb0f9c20d90b49928f29e32ecdad4

SHA512
b967b560c16a61639d7eeb83cf3590b3bc456c0a07378a7f187d7f76e01ce072bf240045495844dcaead3d11ebf5f20ccf43de484b4891c2136fdd03e3eb9521

Download Submit
C:\ProgramData\iCEyocHtffAu.exe

Filesize
29KB

MD5
736cc58aea1f05b3d87cea5b389f9805

SHA1
2a052e3099d6449095e729c065d2cbc7d3bb2816

SHA256
e406143a1628471a04f5c5d6def04723dba001f579446b969a8b55e8d27d4af0

SHA512
239f60a2413a8f71c0ddd8e92cc45cb3e041e4bb8797a8e7d9195a2ca3f860be3f81aaab1d9f9ce18df1f4e6a4efee2966d113d5c6555eeb307ef18ebedd84de

Download Submit
memory/1460-13-0x0000000000400000-0x0000000000635000-memory.dmp

Filesize
2.2MB

Download
memory/3220-1-0x0000000000400000-0x0000000000635000-memory.dmp

Filesize
2.2MB

Download
memory/3220-0-0x00000000022D0000-0x0000000002470000-memory.dmp

Filesize
1.6MB

Download
memory/3220-14-0x0000000000400000-0x0000000000635000-memory.dmp

Filesize
2.2MB

Download