Analysis
-
max time kernel
171s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 22:10
General
-
Target
1e0af3101af3d46c2ea4f6c2b38a1077.exe
-
Size
273KB
-
MD5
1e0af3101af3d46c2ea4f6c2b38a1077
-
SHA1
e7860cba2370f1e4bf28943d2120cbd8c4163bc6
-
SHA256
f89bad6f110464421deffae3b05bc324dda2e42b645abb39edd1f13dcf0cf956
-
SHA512
ae81452483dcf700dcbade6401cb1282c6fd6e6ceea0e7936d80eee3784d1d3969b9b62d4f6672f4eafb70b315d5041120541064ecc01588a2f05e9780baa2de
-
SSDEEP
6144:l0xJxZ9IJu92qJGM1UoBOeY4ycSEllSvVGS5Ey:ux99I82uvmql9hS2SvVGSa
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e0af3101af3d46c2ea4f6c2b38a1077.exe"C:\Users\Admin\AppData\Local\Temp\1e0af3101af3d46c2ea4f6c2b38a1077.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogon.exe"C:\Windows\winlogon.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
273KB
MD51e0af3101af3d46c2ea4f6c2b38a1077
SHA1e7860cba2370f1e4bf28943d2120cbd8c4163bc6
SHA256f89bad6f110464421deffae3b05bc324dda2e42b645abb39edd1f13dcf0cf956
SHA512ae81452483dcf700dcbade6401cb1282c6fd6e6ceea0e7936d80eee3784d1d3969b9b62d4f6672f4eafb70b315d5041120541064ecc01588a2f05e9780baa2de
-
Filesize
120KB
MD50a8e696f9a78680cea12ddd6562533fc
SHA1978e3931b566d6db7d501f190f8c8142d0517280
SHA2568f2ed252a8c13cb7397647afff8fcef549ed33e68e73c717e73baefef9bc7f6b
SHA512c23f386b1779a16b7d50e70f76708d8bea625cfeed4e5d5349dccef66de33ba5e4180b480853878a5d7f6e8d8ae2c4335d57e7f41093a4c6d62999e370393d7a
-
Filesize
128KB
MD53a2ffe9c7f3656132d33a3831d0ad161
SHA12ebf6c18e10a8fb6ef9f8b94d1111e884198856d
SHA256218abac4eda95efdd024493da330979aaf08c2c0a5cd74135c218fbe5d145e47
SHA5126650663aa797da11b12732d25572fdd2a59aa9e96a3bc7aabef266c4b06a8addf5a67cd1bf47c9a9deb2e9b5448b3262fb57f561bfe9b350155fc0dc50a3ca2a
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
4KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB