Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29-12-2023 20:41
General
-
Target
mwVGb4WU.exe
-
Size
753KB
-
MD5
555fbf1135687a8cf1d630baaa6e171b
-
SHA1
5bc6237d0e04747b593ef279e198a48b2dc1f763
-
SHA256
83201d85f85f870c65c3e40e712313fb3764cab64691fcd60a2a466019b2c4fa
-
SHA512
ffffc24d789b6656a8cdf892369cc5534d4cd7df4dc41d52c9e57f643082b97cef89f95d919bfcc53568b6805e184f02ee9da227861791c1de632e3869c516c0
-
SSDEEP
12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ilr:ansJ39LyjbJkQFMhmC+6GD9K
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\mwVGb4WU.exe"C:\Users\Admin\AppData\Local\Temp\mwVGb4WU.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
753KB
MD5555fbf1135687a8cf1d630baaa6e171b
SHA15bc6237d0e04747b593ef279e198a48b2dc1f763
SHA25683201d85f85f870c65c3e40e712313fb3764cab64691fcd60a2a466019b2c4fa
SHA512ffffc24d789b6656a8cdf892369cc5534d4cd7df4dc41d52c9e57f643082b97cef89f95d919bfcc53568b6805e184f02ee9da227861791c1de632e3869c516c0
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
776KB