Analysis

  • max time kernel
    148s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/01/2024, 05:09

General

  • Target

    3bf922c888d36d880d4abb9ab02a2007.exe

  • Size

    8KB

  • MD5

    3bf922c888d36d880d4abb9ab02a2007

  • SHA1

    882798e4aa557a7d6b49a27a86dd93f13fd7ad40

  • SHA256

    e52fdf6405eea5e2619e4882658a9109ea803ead950dca8f0638aadd2ceaeee0

  • SHA512

    f10337efe36e8f2124328a1e62e51433c6f3b3645897f2dc63f883321356f7268047cce6f84f890600b29a472861be4664a837d1f41b1bcff89a69b7953d2cd7

  • SSDEEP

    192:zWizBojjLY2W9cOp1fFaNJhLkwcud2DH9VwGfctlnO:zuU2C3daNJawcudoD7Ui

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3bf922c888d36d880d4abb9ab02a2007.exe
    "C:\Users\Admin\AppData\Local\Temp\3bf922c888d36d880d4abb9ab02a2007.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:860
    • C:\Users\Admin\AppData\Local\Temp\4362.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\4362.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\4362.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\3bf922c888d36d880d4abb9ab02a2007.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1072
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\448B.tmp\batfile.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1740
        • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
          java -Xmx256m client 1 live live software members english game1
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5004
          • C:\Windows\system32\icacls.exe
            C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
            5⤵
            • Modifies file permissions
            PID:4904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\4362.tmp\b2e.exe

    Filesize

    8KB

    MD5

    939a888808a8da6e1f8fe8a7a535d2a2

    SHA1

    9bc1c8aea0ad2d4afc8ccdb10983d5042a42580a

    SHA256

    7b90facaba5111fff1f9da6c3b92ca9c884ee56e4a2f4324dbbe0e75352f1fb8

    SHA512

    9e9028b7f7b3ee4daa2d96517c461420db1020eab110089dda65400634e9a5c8a92ce5c5c87f37a814acc52a286934ee33ac13f4521f997b44c2322fd0238b12

  • memory/860-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/860-9-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1072-11-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/5004-19-0x000002CAE1900000-0x000002CAE2900000-memory.dmp

    Filesize

    16.0MB

  • memory/5004-26-0x000002CAE0080000-0x000002CAE0081000-memory.dmp

    Filesize

    4KB