31fbbeacae3a61e9aff039ca5670f0c14bc9c2f3f915ee28a0bdfbd2b1766bc9

Analysis

max time kernel
147s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

41089f34dd04998818d313d244d13604.exe
Size

173KB
MD5

41089f34dd04998818d313d244d13604
SHA1

fce6527a9030c62173aac5df7283cf7fb86d8734
SHA256

31fbbeacae3a61e9aff039ca5670f0c14bc9c2f3f915ee28a0bdfbd2b1766bc9
SHA512

9c2836a8d832f1e98e8ed64988cda604ebaf1f5ba68bc9a98b788ec843efcdcf6e536ec4a8e328d6a968616677dab763b2d2608c194756b05617b1a5e24505be
SSDEEP

3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/18Fpjl:o68i3odBiTl2+TCU/al

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart"	41089f34dd04998818d313d244d13604.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SHARE_TEMP\Icon12.ico	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\SHARE_TEMP\Icon14.ico	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\bugMAKER.bat	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\winhash_up.exez	41089f34dd04998818d313d244d13604.exe
File opened for modification	C:\Windows\winhash_up.exez	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\winhash_up.exe	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\SHARE_TEMP\Icon3.ico	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\SHARE_TEMP\Icon6.ico	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\SHARE_TEMP\Icon2.ico	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\SHARE_TEMP\Icon5.ico	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\SHARE_TEMP\Icon7.ico	41089f34dd04998818d313d244d13604.exe
File created	C:\Windows\SHARE_TEMP\Icon10.ico	41089f34dd04998818d313d244d13604.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3984	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 3984	3872	41089f34dd04998818d313d244d13604.exe	88
PID 3872 wrote to memory of 3984	3872	41089f34dd04998818d313d244d13604.exe	88
PID 3872 wrote to memory of 3984	3872	41089f34dd04998818d313d244d13604.exe	88

C:\Users\Admin\AppData\Local\Temp\41089f34dd04998818d313d244d13604.exe
"C:\Users\Admin\AppData\Local\Temp\41089f34dd04998818d313d244d13604.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\bugMAKER.bat

Filesize
76B

MD5
53fef2af90114aed9b70d31e691041b7

SHA1
eeef25ff39053a59990bf8c0203d3864de689b62

SHA256
39dd598307637ad885e77e284bd553d790f461756096eb55703ce8dd76f38f82

SHA512
92a78356a291b6869ddb800964c0598c0d2d96249e33ba8ccc1422b0d29688851222e3b11b59cfbd5397fe8cf9bfef1bbfc9054bfd0ed856dac909859ce57b1f

Download Submit
memory/3872-24-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads