4cf7cdca827acaf3e8881099a4296976f66bf40e0a435b2075888aa1578b0384

Analysis

max time kernel
165s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0305f0fae4e465eb05ec7b6484b7f212.exe
Size

156KB
MD5

0305f0fae4e465eb05ec7b6484b7f212
SHA1

641b85868ea5da90b1d71de7ef63b21484e2dc58
SHA256

4cf7cdca827acaf3e8881099a4296976f66bf40e0a435b2075888aa1578b0384
SHA512

dc980d71a3dfa39bf7a84c0c4e9df0a2164c2ceb053bd4f54268570b0d56980832bd69ab394da875c17b084593426e32e57b2ce6a3ede65d88c6b597404de71a
SSDEEP

3072:yBd11E2MtU7Qv0w4ZRRQMMDwtIMCeFP4ANQ4oQZiEcS2Dym:QdrE2R7Qvb4tQTaCeFP4AqWMb

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	0305f0fae4e465eb05ec7b6484b7f212.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	sdwij.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	0305f0fae4e465eb05ec7b6484b7f212.exe

Executes dropped EXE 1 IoCs

pid	Process
2396	sdwij.exe

Adds Run key to start application 2 TTPs 50 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /d"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /D"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /E"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /N"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /m"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /B"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /V"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /j"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /k"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /a"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /C"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /I"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /P"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /i"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /Y"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /Y"	0305f0fae4e465eb05ec7b6484b7f212.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /X"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /q"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /f"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /S"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /M"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /h"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /o"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /s"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /r"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /z"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /u"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /O"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /Z"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /l"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /n"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /v"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /G"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /J"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /L"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /e"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /Q"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /T"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /x"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /K"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /t"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /p"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /W"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /y"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /R"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /b"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /g"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /H"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /w"	sdwij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdwij = "C:\\Users\\Admin\\sdwij.exe /A"	sdwij.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4952	0305f0fae4e465eb05ec7b6484b7f212.exe
4952	0305f0fae4e465eb05ec7b6484b7f212.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe
2396	sdwij.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4952	0305f0fae4e465eb05ec7b6484b7f212.exe
2396	sdwij.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 2396	4952	0305f0fae4e465eb05ec7b6484b7f212.exe	96
PID 4952 wrote to memory of 2396	4952	0305f0fae4e465eb05ec7b6484b7f212.exe	96
PID 4952 wrote to memory of 2396	4952	0305f0fae4e465eb05ec7b6484b7f212.exe	96
PID 4952 wrote to memory of 2396	4952	0305f0fae4e465eb05ec7b6484b7f212.exe	96
PID 4952 wrote to memory of 2396	4952	0305f0fae4e465eb05ec7b6484b7f212.exe	96

C:\Users\Admin\AppData\Local\Temp\0305f0fae4e465eb05ec7b6484b7f212.exe
"C:\Users\Admin\AppData\Local\Temp\0305f0fae4e465eb05ec7b6484b7f212.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\sdwij.exe
  "C:\Users\Admin\sdwij.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\sdwij.exe

Filesize
156KB

MD5
57cb0a5f530fc5568debcdba29674ae3

SHA1
53aabfca8e35156abd7de6018e85a64ba638d2e1

SHA256
71533bbb63a5564d01ed39d006b405baf44ccb4c0f33a33a81d18394ece405da

SHA512
376a7c7e8cbccbe61b9aaa97848bf2acca2200edfd16344f9bd9a0bbacad2effa32bf0aa2994421ab4c0ce468c361c8f3c73c5657f1d6358639f34c824a7b387

Download Submit
memory/2396-34-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2396-38-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4952-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4952-3-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download