Analysis
-
max time kernel
169s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 06:42
General
-
Target
0c5ba058f68f12cc55caa6c5f60533d7.exe
-
Size
924KB
-
MD5
0c5ba058f68f12cc55caa6c5f60533d7
-
SHA1
27ef3d9cc808d24f8b195d88236915a1526f7d1f
-
SHA256
e042430059b0a9fb5fe4f2bdd38fa0a138b6f46ee86072ca2382b2df8c117710
-
SHA512
094828fcbb5bbe6659594730823d1f03670b12653260b2a5b850fc10e74be5537d680216432f7a08f1cf258d7bfbed37f3fc9fdbea4d7134d0f0a63e1edcb905
-
SSDEEP
24576:1YfYB6zV9pbAbVMRAn4vRDrSDLD6QmXI8E7wxnX:136mw84JDr2D7m4zUdX
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c5ba058f68f12cc55caa6c5f60533d7.exe"C:\Users\Admin\AppData\Local\Temp\0c5ba058f68f12cc55caa6c5f60533d7.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\program files\common files\microsoft shared\msinfo\Server_Setup.exe"C:\program files\common files\microsoft shared\msinfo\Server_Setup.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
323KB
MD529342671dc0a818b3be4bed2e73a08dc
SHA12aa134455e85ccfa31ee553fc778f67630f9d8dc
SHA2564107b5b053818bc7d554d37e53ec12d963db554599ff89e67635a4da0b3a0af2
SHA51259910be1348a2ff96e243d3df2853f784a0575bf9e4497c1ad36bb1977079aa01c7ca96fce7ecd0a86b2519cd56cec75f8819ec5c9a6ecec75a7b671ad816952
-
Filesize
381KB
MD571ba45b36617ede94c4a70ac37112926
SHA17d3127f4a206b2c95a9f7be369b1ebb44d82fd12
SHA2563efacc33a216a447f5dd8a40af5b3a5a2fd3002c8a1a0d4a22b6a9068be20746
SHA512553116faf250691bec2c9fea07bdcaf022fe3ad976c9c3c692ea252c89defdf3d525a14c84a9fee8da04ed1e5e84ef3b754a1130ba92b78c5ce457d6604646d4
-
Filesize
65KB
MD5ab6a2c2a0edcf74d951a5f7fd910c47c
SHA14f9a278ce8b7ef0ef29baa655c77f4c5935615d8
SHA256887bd8035da94389ad15c2a984e6582be817d1913ad51e257c85a50a419d32c8
SHA512041674cc057d8d3afa04ec7070026271b177cf15ef7ad99991dcd03714a8e5d9ad528e88ced15fff1d7b2ab4efd7004d3896f6f58d81602ded38e70e7826a098
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
964KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
964KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
336KB