Overview

overview

10

Static

static

3

165378b5cf...a4.exe

windows7-x64

10

165378b5cf...a4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/01/2024, 14:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    165378b5cfcb952711b917ffdb1ac7a4.exe

  • Size

    260KB

  • MD5

    165378b5cfcb952711b917ffdb1ac7a4

  • SHA1

    2e5a0a653141fd44e452e826ce77797cf79ca283

  • SHA256

    3306634291e1d50e273177fb1c65e3c9d9b76c6d5da33a497c9f93a352e88659

  • SHA512

    62ad37e6241dc1ce33936a3536278329d0a0c27985bd2387331f7501a24711077be4e8cc6a45636538879ae8591ac62a9626ff03158a2ae06f1ade93aa3e4365

  • SSDEEP

    6144:sgRlSUhL25VGQllHiU6ZdCFqhVeVHEv++X:sgRgUhL2lHiU6ZdFPeilX

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\165378b5cfcb952711b917ffdb1ac7a4.exe
    "C:\Users\Admin\AppData\Local\Temp\165378b5cfcb952711b917ffdb1ac7a4.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5044
    • C:\Users\Admin\wufiw.exe
      "C:\Users\Admin\wufiw.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:636

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\wufiw.exe
          Filesize

          64KB

          MD5

          67e9acfd72aed629e9a5e54a953717dd

          SHA1

          c5f2e1cd788f8741572ced91accb0012d74274a8

          SHA256

          33053a31b5677727ee05f7f39636bd2040f33ef4cd5eb364a3687f9e0fb87d0d

          SHA512

          d84aa4d15249c3eb3ff7dd183f77637ae51834b1024c0ca6d42ea788d57aed93a5e32e6eaf3bcbfe9e966bf407d8efbfbda82f65ee9ca4d7f7bddd3350c3242f

          Download Submit

        • C:\Users\Admin\wufiw.exe
          Filesize

          256KB

          MD5

          fc499c3107675289268b02aa5da0010c

          SHA1

          18155ba94b9465b4649dee53e815471b3eac755e

          SHA256

          d32beecf45f1d396fa3cddd284da81c226c8c0435fe527ebe5176b7eab873c71

          SHA512

          4eeae8825e9aaa20bc60a893e0eb7cd8700ab30066f7524e62b551dba4734a1df24ed934127986d4b494d46e1d84b6c6630f1d8948580948cc79a7138987daf3

          Download Submit