Overview

overview

10

Static

static

3

0abff87ffd...ee.exe

windows7-x64

1

0abff87ffd...ee.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 01:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    0abff87ffdb2ef66c7cfc3f96fc785ee.exe

  • Size

    156KB

  • MD5

    0abff87ffdb2ef66c7cfc3f96fc785ee

  • SHA1

    0ae88e5005542e0a37d021260b71ce0109ad292f

  • SHA256

    a7a7d4b9df6b9aaa5b5627c950b1b484d9506d2d50dc09e85b96748495378a44

  • SHA512

    80853ebb0a32b4aba735cf56e16c90ea7fa0027fbeb6d810636a11f37bd4183b4bd385904ea57c1e8a86e702d6c1e6b74654b87e95c1415b397784b5b80981cf

  • SSDEEP

    3072:PNMt0S4aZhJdxKPE+vgu36MN9vqKyHjm6I1JDVOc2W4oQZiERg7:7m7d0zvhqMN9vgjm6ILDVOAWA

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0abff87ffdb2ef66c7cfc3f96fc785ee.exe
    "C:\Users\Admin\AppData\Local\Temp\0abff87ffdb2ef66c7cfc3f96fc785ee.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Users\Admin\juesuoc.exe
      "C:\Users\Admin\juesuoc.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1644

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\juesuoc.exe
          Filesize

          156KB

          MD5

          7fbf38f6c5ed657e951541c91c6ae3d7

          SHA1

          f4be0c202ee8631ef1338d8d4f28d5c48c6c7829

          SHA256

          3915705b364787ac60e33f381a592a7778d9367037807766d8ec5dde1f8b00e4

          SHA512

          b263b6dba75e493115bcfce74701d7d0fba8f443141f764dcfb3eb3e70b0477b0a1941b218904e4f74c19d46a1198db1c3eeedf90fe7a6bcaf9696ef61281b73

          Download Submit