Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 03:22

General

  • Target

    02b72f46ffbefe3f47b62cdd7a7c5bdf.exe

  • Size

    15KB

  • MD5

    02b72f46ffbefe3f47b62cdd7a7c5bdf

  • SHA1

    3daefad01bdcecd37ea32a0c3396c655cb8e5dad

  • SHA256

    23a4443a2cc8df68b4b90f5581aff7d4750b1db2aa5dd1822bf31c9243567905

  • SHA512

    ab22f740a2b6e810d4083450069a02a7bc1fa540ad93642fca6aac64c7aafd2b4a1d7266095676a3f5171c12b2ce0b70b099d1dd8e62ab5ccab878e7fe2fa2d6

  • SSDEEP

    384:xTuJF0BeRm5HdGdrfB+ylNHQbR9uyWcisZsWQwF:xTu/0B5dGpfXP6R9uBR3c

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02b72f46ffbefe3f47b62cdd7a7c5bdf.exe
    "C:\Users\Admin\AppData\Local\Temp\02b72f46ffbefe3f47b62cdd7a7c5bdf.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    PID:2544

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\77611.exe

    Filesize

    487B

    MD5

    21bca3406f06003e03614a88b00e0403

    SHA1

    ce0a4cfee50e9ec5887365c17eb51d9837bc5bc2

    SHA256

    d5e818ea15a3cb9f79434b4524b376196c8bc60bb1a9ec3f615d888822cf370e

    SHA512

    6f4391159be9f6a09c34b3261831f0e10dd0dbd595ff0a39b212d4dea80f275c085a9e553add116ad1b131c5667ab60baf823eca12a587deb2cee18e4f930f40

  • memory/2544-0-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/2544-15-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB