Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
30/12/2023, 04:33
General
-
Target
0e9944a68e769e60f718eed8fc9bbe8f.exe
-
Size
3.0MB
-
MD5
0e9944a68e769e60f718eed8fc9bbe8f
-
SHA1
fb143881d51567e30d775a6feb9e689e708bf79d
-
SHA256
30a7c17ac7dcfcee1c2f62987bbaaa0161599ebe58329fca444adca7cc1079ee
-
SHA512
6fadab0e61bd497d75f2e79a00be8dfe553b30e0c1ed791c8e4582bdabb6159619a4468e2b92ac1ea32c97cc4554f7d735ab8ba5ddf42fb573277e3ee6f95011
-
SSDEEP
49152:FFbRs47kQlDJqDvpHf2YDiF1yei0UYhNNEHCf/wrCjsru8/q106y0lhOdyj:z7kYD+p/1DEYiPEHC/OOqur0FjEj
Malware Config
Signatures
-
Drops file in Drivers directory 11 IoCs
-
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 13 IoCs
-
Loads dropped DLL 33 IoCs
-
Drops file in System32 directory 44 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
-
NTFS ADS 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 39 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e9944a68e769e60f718eed8fc9bbe8f.exe"C:\Users\Admin\AppData\Local\Temp\0e9944a68e769e60f718eed8fc9bbe8f.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FoxitReader22_setup.exe"C:\Users\Admin\AppData\Local\Temp\FoxitReader22_setup.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fox4F99.tmp\Foxit Reader Setup.exe"C:\Users\Admin\AppData\Local\Temp\fox4F99.tmp\Foxit Reader Setup.exe"3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\gun4.25.exe"C:\Users\Admin\AppData\Local\Temp\gun4.25.exe"2⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1416 "C:\Users\Admin\AppData\Local\Temp\gun4.25.exe"3⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1436 "C:\Windows\SysWOW64\svehost.exe"4⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1456 "C:\Windows\SysWOW64\svehost.exe"5⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1468 "C:\Windows\SysWOW64\svehost.exe"6⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1460 "C:\Windows\SysWOW64\svehost.exe"7⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1472 "C:\Windows\SysWOW64\svehost.exe"8⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1464 "C:\Windows\SysWOW64\svehost.exe"9⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1480 "C:\Windows\SysWOW64\svehost.exe"10⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1476 "C:\Windows\SysWOW64\svehost.exe"11⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 952 "C:\Windows\SysWOW64\svehost.exe"12⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107B
MD5918cd02cdd0e6b18e5ab0d180687df26
SHA162defadba6f597c9f7b6e9c5a34e8df7fac7eba6
SHA25636c8f8b274b1ef25424a7f76b7237df331700811eb0ebd78756c4e63815da3e5
SHA512e0dea647d2a26ae6c723ec051dd3cff553d7b85d210978c8cc3bbf4de201a06d0e201c70372839959ae4542517db28df4db3048132200fdbad841211fc704a91
-
Filesize
107B
MD5b133d7a997c100ea575f2870425bd5d6
SHA16d9dfe4bf3f704f897a441fb15d6d578d17bb960
SHA25642c0fdaff590e68b41e8f508b63259905d56771f21e674eedcee9fa97e259a22
SHA512cea77cea93398f2d28c2dfd7631fe95d3049592abff7d4ee80899f502ccf8cfecf5d373b8b66ce95f3ad6934c700815cbb03c09625c23123c0e4bf48e7c439f8
-
Filesize
107B
MD5781f1a86923a189ee8d4a958af78ba2a
SHA133eb9d9fa230dc371a2fd9bb2fbea940004d3e1f
SHA256c787639d99358c785bf9bda7f96beda985d08d2e41c1922d024c3e46c89cbdb5
SHA5129b36ea55ffbbf14f17f796c7eafc130aec1ca8d0038b91a780e2f4ea75e7013723bd845c653b782c59c69b79c1f24e826e189f7825511d0971513e77829eb6ef
-
Filesize
107B
MD5e1ce25a9830b55be5ee18016f97802a0
SHA1a18d6e1e6bb46f7cc140154126b57c4631e34df3
SHA2567274cdd6332c74f2f5b2b329185bdba80127f200d2f807439e59555ec997d173
SHA512826670f42d5aa319cd2972d1066be1e25a6e3a1fcd426a7d02e0153ce174d93ae869cba83bb1f5ac36bfcb5fd279b158a400317c964fbe24be55cc8d00f2c9ce
-
Filesize
107B
MD5b58bc3eec6184287d49b4f9ae3382805
SHA1e1cc5db92d7ef408050350f75bfe33484256a547
SHA256da126ebbe7f4a15855e781854ecee27ffe4bd7d8039bdba17b2a244e975655c0
SHA5125c52ee49265de5cfd0e27660b89d410adbf7c0df6c872bb2aa046f0e130f084a106baf8e286f0f04646198f7bb761ed9cadb8ef2ad0b81d5c7f241a03e1734e6
-
Filesize
107B
MD5299c99adbbf15a158d902766537bf675
SHA106c42a78d97b8c928b105943dfdff77712e29d35
SHA256f191483912407d3cf15aed822d0cab25e222a6addce5359bd0ed45966d1009ad
SHA512d10d4b8c28c5ca4b03d15a3c7cfbb38573879296b3e139c23fdc738a876bc005e9c7e267181d5748a64c2fec608dd09066efc94e6b5bf9784497267d5969543c
-
Filesize
107B
MD5f19c1f5e4bb550bc560029528fe66e5b
SHA1ccf749c5a2a98c9ab8fb53e841ae37891751edd1
SHA25650443ea296ea8f7c5496327ca976cff4f9855cd79e488fa8fa0e6d72b77573f9
SHA51217849f7f977ec85f774cbc2c6fabdfc64f9e6fb7ad0bf2a55d6335442a5f163afbeb36b417cb5be717cdca29a507d6a02387c991d502d40054a5c86433b96a51
-
Filesize
1.4MB
MD56aa5fe44c731afabc98d2c8afcd5d2d9
SHA102a690431a6d7feb5a51720e61c4928d6786f480
SHA2563d69decef50b4ee05656ffab20eb5ad33fec0db7868c5713d2c4e3eadeaed057
SHA512ffdfc41c3a38e072116cbbe2de14c5acd289c49f7313f645b807fa291dc3b1810fa5f1c1ba7d1a9205fddf321466d8b1e1d99c1ae2aebdd54a6ca910d3632d01
-
Filesize
1024KB
MD5ec25d613abca036398766b75c7456136
SHA1ce814eac8c0e982df8fc111d1731c1783438eb33
SHA256b02d8f049afbd407034593aedc047c25332c5075f726e5536f943477a86e0346
SHA51233af98e59fb8d5c77c6f9f5957e77092af9e4888cb46ab270b77c7e143b3be2c59b4924af3dcbeb68ea150fe70cc3f7de32d2a279ff5f82b91ab8ed38f94a991
-
Filesize
896KB
MD5fc2a36eab622edefed89535d99863e8b
SHA149a476e5898df62a14a539f9e1dbd00385eaae27
SHA2568223209a5e4fa00d0706a95af2477065d1d8783e9147cf25316f71f1ae5fc517
SHA5122bb663af9a5cb7d9cf63ee8dfd964516fc226c65ddedcb3f7014cca375b11ec71a84ece7f9f7d67ffef5fd9d9eef59ed349149652331b0232d0f4357ceacd51f
-
Filesize
92KB
MD5c600858aea4aa2288504923af67fd97b
SHA1e2d3f8e2f2c246ec39fe12eb803fa246273876d7
SHA2569d12951e6ce800cb7738d33539efd253d5d04ae18db7730e64efb7b1f17a4447
SHA512f508965e6b7b77b5a7c5f07fa9bb3be2d976d45a44e8421d5060909f52dc0bbfdc751c4cd4df6120e134f15ddbb23b43e52d74884878a11c0fae5df363aea849
-
Filesize
86KB
MD53eb0beb8e318646104362537570fc6bc
SHA13cb48ea9073fcca5835adad307e14ebf0cfe7279
SHA256ab3f8c80b85aae70f89c8e7919d7dd147c2bc3ec68769e0bdb05fcc4083e3643
SHA512db5fd16749641de6282d36af7b1921f908850ece3429ffe5ad33d990431bf4990f0314d28af082394af1f4d66516d9d89806a38e2801c34b4dd1ccb69bfafe47
-
Filesize
920KB
MD50cc4d625f7ede56f5f8832e421a61865
SHA1e037c88deffe0ce61dc19d64bb60d78d9ab3b068
SHA256576dcc08435e14a385ed84ad6618a7cd14c557903233fa8cadb3de7b2f00381a
SHA512bac8009778cb0536c7e62ac459a69381b818022af8a50577becfbe51e2f9128a0516339d4eb6d27dd862e628a3366db0544182dfcd3a4c52d7b29af3edd165c9
-
Filesize
234KB
MD5cb0afba4f0fb6ca2b2ea0d2c3e86b588
SHA12459367892e012314b451e05de1f1162448a05fa
SHA2561b0fe60175c88f7cd3f3765b2f0f3eb1530b2e5e5b51f89a83e0322de32bdcf7
SHA512a4e2d66af68dee67be5883c4770c1339b6be4847a993619389404af6a7ec9763361d9a14c632ca6704f63d84b05483f4bea2ec035b466fdaf03ce68c5cbca128
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
84KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
84KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
84KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB