Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-12-2023 20:24

General

  • Target

    03031e3da2b77b8ed8935d16070f1cf0.exe

  • Size

    1.1MB

  • MD5

    03031e3da2b77b8ed8935d16070f1cf0

  • SHA1

    cc3fbf1d78bb14035192e4e2d9070b42162cb680

  • SHA256

    8253c21a908d4340fd2a15bbf71c765e82216df28f7631bf5524b72f8fddeb2c

  • SHA512

    007d920f704208c72fa0844674c6ffbfda4da3c80ac7a19a0e67d219ad0c8df6af1b9afbc8c295dc790a038a869ae205a754441c8004a9f2ad01c28f58690f4f

  • SSDEEP

    12288:Evp/rM/nhpnTr0fQUyCc7384RYliO+fUl3L4KbLuajCSXoeEevbUQrk4bkISBt2l:EBg//TmRc73SlNpX9d3YBAopcFeC

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03031e3da2b77b8ed8935d16070f1cf0.exe
    "C:\Users\Admin\AppData\Local\Temp\03031e3da2b77b8ed8935d16070f1cf0.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3804
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\51244521\51244521.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im 03031e3da2b77b8ed8935d16070f1cf0.exe /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1140
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c start C:\PROGRA~3\51244521\51244521.exe /install
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1544
        • C:\PROGRA~3\51244521\51244521.exe
          C:\PROGRA~3\51244521\51244521.exe /install
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:3208

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\51244521\51244521.bat

    Filesize

    290B

    MD5

    11db165c5a4bfad89f097d3b12a0f94f

    SHA1

    e03678c708e0385145cefb3a377a33a131ac045c

    SHA256

    c28d27e177daac4682bb3148cfcd46fbd9b9ccd5dfc4a004cd29e6ad5fb3c5e3

    SHA512

    787204c0af9ee345f222e788d2231a8fcddb84e6d029bb6976673b19cd337bc23a5e631a77c11f0f862967f755db1eaded89f166feefc1ccb0331c6ed2f33c69

  • C:\ProgramData\51244521\51244521.exe

    Filesize

    1.1MB

    MD5

    03031e3da2b77b8ed8935d16070f1cf0

    SHA1

    cc3fbf1d78bb14035192e4e2d9070b42162cb680

    SHA256

    8253c21a908d4340fd2a15bbf71c765e82216df28f7631bf5524b72f8fddeb2c

    SHA512

    007d920f704208c72fa0844674c6ffbfda4da3c80ac7a19a0e67d219ad0c8df6af1b9afbc8c295dc790a038a869ae205a754441c8004a9f2ad01c28f58690f4f

  • memory/3208-22-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/3208-34-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/3208-35-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/3208-23-0x00000000007C0000-0x00000000008C0000-memory.dmp

    Filesize

    1024KB

  • memory/3208-33-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/3208-15-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/3208-16-0x00000000007C0000-0x00000000008C0000-memory.dmp

    Filesize

    1024KB

  • memory/3208-17-0x0000000000770000-0x0000000000772000-memory.dmp

    Filesize

    8KB

  • memory/3208-18-0x00000000007B0000-0x00000000007B1000-memory.dmp

    Filesize

    4KB

  • memory/3208-21-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/3208-36-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/3208-32-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/3208-26-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/3208-25-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/3208-24-0x00000000007B0000-0x00000000007B1000-memory.dmp

    Filesize

    4KB

  • memory/3208-27-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/3208-28-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/3208-30-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/3208-31-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/3804-4-0x00000000023C0000-0x00000000023C1000-memory.dmp

    Filesize

    4KB

  • memory/3804-1-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/3804-3-0x0000000002360000-0x0000000002362000-memory.dmp

    Filesize

    8KB

  • memory/3804-9-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/3804-2-0x0000000000680000-0x0000000000780000-memory.dmp

    Filesize

    1024KB