Analysis
-
max time kernel
93s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 14:28
General
-
Target
1b6cece5f8a8a9e1d4478116bd7dd5aa.exe
-
Size
4.0MB
-
MD5
1b6cece5f8a8a9e1d4478116bd7dd5aa
-
SHA1
e7e834d4097010f9c67d56fd6b9299a6bf198174
-
SHA256
dbc19471ecdeb4ba023f2d145858e2bfe18a17af68065a035738637304af681a
-
SHA512
4377d5b2e15d39158cc9ab555ce826c1943dfe9b35e569d3b566d6dc83f7b87f743ee248d691817dfe020e265ab829b6e85cca1aba798b460d78af90bdf378de
-
SSDEEP
98304:2nsmtk2aqk02VdBXD0NYTzjv9UzvassGeR6B6q24Ro7:oLNk02Vd6YrOLbTeR6BLm7
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b6cece5f8a8a9e1d4478116bd7dd5aa.exe"C:\Users\Admin\AppData\Local\Temp\1b6cece5f8a8a9e1d4478116bd7dd5aa.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_1b6cece5f8a8a9e1d4478116bd7dd5aa.exe"C:\Users\Admin\AppData\Local\Temp\._cache_1b6cece5f8a8a9e1d4478116bd7dd5aa.exe"2⤵
- Executes dropped EXE
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x324 0x2f81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.0MB
MD51b6cece5f8a8a9e1d4478116bd7dd5aa
SHA1e7e834d4097010f9c67d56fd6b9299a6bf198174
SHA256dbc19471ecdeb4ba023f2d145858e2bfe18a17af68065a035738637304af681a
SHA5124377d5b2e15d39158cc9ab555ce826c1943dfe9b35e569d3b566d6dc83f7b87f743ee248d691817dfe020e265ab829b6e85cca1aba798b460d78af90bdf378de
-
Filesize
3.3MB
MD56dd2033d8b555023c7bf1e0e67e89899
SHA1f435ff19418964a7e279ee9c7992e0ae98f12085
SHA256095d6b8102f8268117adb281f10efced652a0b42236419271ce375dd3b4f8c25
SHA512ee5a677ffeed4477987fe0916456b071cd8e31684f8256dc05bdad4c7e2e7f4801d5be34f9ac13115ab1d7164f91efe9bf62573f5f0d2d800e19ec4ef008d3bf
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4KB
-
Filesize
4.1MB
-
Filesize
4KB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
26.0MB
-
Filesize
26.0MB
-
Filesize
26.0MB
-
Filesize
26.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
26.0MB
-
Filesize
26.0MB
-
Filesize
26.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
26.0MB
-
Filesize
26.0MB
-
Filesize
26.0MB
-
Filesize
26.0MB
-
Filesize
4KB