Overview

overview

10

Static

static

3

21f4cc20e7...21.exe

windows7-x64

10

21f4cc20e7...21.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 00:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    21f4cc20e7ac31bf409f6685ad8c5521.exe

  • Size

    100KB

  • MD5

    21f4cc20e7ac31bf409f6685ad8c5521

  • SHA1

    ad12b494c0141ab94e68b718f694ef65faefbe26

  • SHA256

    19fe9d965d4b966ef990420a6fc9b661fe3ee3a9f3aeda27fca056bb5c89a70f

  • SHA512

    9d65788952fa8670f5f9e83348f38c78240c549d7c2ed5795c9bf4bd3b47036735698569d3035fbaddc031d2d89d5889111a778d610ff483dedadd65860aeb1a

  • SSDEEP

    1536:m7tGM82NTzwlMGAc4ohrPXo+73Rez8b0Sy1NIjnZr7:UwcurPX7C1Cnt7

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 51 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21f4cc20e7ac31bf409f6685ad8c5521.exe
    "C:\Users\Admin\AppData\Local\Temp\21f4cc20e7ac31bf409f6685ad8c5521.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\ceupuw.exe
      "C:\Users\Admin\ceupuw.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:220

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\ceupuw.exe
          Filesize

          100KB

          MD5

          e90b6caeaf4ce4fbb766b73d1ea52f3f

          SHA1

          c8e34e37cfce9e8d7c75dcb4aff2bfc777be6ed1

          SHA256

          e7d4106f717adca6a96554608b02f7ded462f289db84245272e3257b937efae6

          SHA512

          7bd3f6250c249ab49b1db1c40df4dcc9f9e923ae77d3198e3a08e55041fe1cc9b8cd45ae0a01d8b4ffc88f62d0770ced0b275de4cf0e9d126413f575a911e09d

          Download Submit