Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 22:11
Static task
static1
Behavioral task
behavioral1
Sample
05469e24bd9fc5b10271cca5ab1e9b4e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
05469e24bd9fc5b10271cca5ab1e9b4e.exe
Resource
win10v2004-20231215-en
General
-
Target
05469e24bd9fc5b10271cca5ab1e9b4e.exe
-
Size
323KB
-
MD5
05469e24bd9fc5b10271cca5ab1e9b4e
-
SHA1
4a836f602bda13243ce69776c5343255e8690bbd
-
SHA256
e4fb7d3f5437f91f4159bb0c8e10addf1d775c5ff5374fc4cd0328064e663ad7
-
SHA512
fd2eff1f7a079e92006bdf7850cacf2d06aca3d0c4ef1529d257bc4957f67e9285b817dd220843973a76e8e96156d92a7b46331f172ff66930489d138916c1bd
-
SSDEEP
1536:FkoVgaYJLFfLJEUI1qeXxyGA3N5eyD8SlNDSzvHFRiCCVGCWPGeSe+eooOoaoCok:/tYJLFfLoWGA3N5ecYxo
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation 05469e24bd9fc5b10271cca5ab1e9b4e.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation Del492E.tmp -
Deletes itself 1 IoCs
pid Process 2148 Del492E.tmp -
Executes dropped EXE 1 IoCs
pid Process 2148 Del492E.tmp -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\ddhnj.vbs 05469e24bd9fc5b10271cca5ab1e9b4e.exe File opened for modification C:\WINDOWS\ddhnj.vbs Del492E.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "hao.thehh.info" 05469e24bd9fc5b10271cca5ab1e9b4e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "hao.thehh.info" Del492E.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1364 wrote to memory of 1976 1364 05469e24bd9fc5b10271cca5ab1e9b4e.exe 20 PID 1364 wrote to memory of 1976 1364 05469e24bd9fc5b10271cca5ab1e9b4e.exe 20 PID 1364 wrote to memory of 1976 1364 05469e24bd9fc5b10271cca5ab1e9b4e.exe 20 PID 1364 wrote to memory of 2148 1364 05469e24bd9fc5b10271cca5ab1e9b4e.exe 24 PID 1364 wrote to memory of 2148 1364 05469e24bd9fc5b10271cca5ab1e9b4e.exe 24 PID 1364 wrote to memory of 2148 1364 05469e24bd9fc5b10271cca5ab1e9b4e.exe 24 PID 2148 wrote to memory of 1836 2148 Del492E.tmp 21 PID 2148 wrote to memory of 1836 2148 Del492E.tmp 21 PID 2148 wrote to memory of 1836 2148 Del492E.tmp 21
Processes
-
C:\Users\Admin\AppData\Local\Temp\05469e24bd9fc5b10271cca5ab1e9b4e.exe"C:\Users\Admin\AppData\Local\Temp\05469e24bd9fc5b10271cca5ab1e9b4e.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies Internet Explorer start page
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\system32\wscript.exe" /nologo C:\WINDOWS\ddhnj.vbs2⤵PID:1976
-
-
C:\Users\Admin\AppData\Local\Temp\Del492E.tmpC:\Users\Admin\AppData\Local\Temp\Del492E.tmp 1084 "C:\Users\Admin\AppData\Local\Temp\05469e24bd9fc5b10271cca5ab1e9b4e.exe"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer start page
- Suspicious use of WriteProcessMemory
PID:2148
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\system32\wscript.exe" /nologo C:\WINDOWS\ddhnj.vbs1⤵PID:1836