Analysis

  • max time kernel
    159s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 19:21

General

  • Target

    49816a8397e134d8fc34c2c8d004912a.exe

  • Size

    144KB

  • MD5

    49816a8397e134d8fc34c2c8d004912a

  • SHA1

    625545a06c6c35d0258534c1c4cb4efeb14a44ba

  • SHA256

    2047a6293bf48347746b1eb89bba86a722f6888fba1a55cccc9c6fa6c59efb2c

  • SHA512

    5924273c427a121269fd05e57a4c202fd6951afa878c1145c445a43edff24b379df75d6d4f5c86d88803861e2ac75c9b4d9ebd80ba19b7c41229cc6f31d5f272

  • SSDEEP

    3072:RD01BKcEUqZhplZRC7/veXx8pUPkDRcrLNfisA/N:RYLlEUqzPZ8eXx8pUsDRcHNfisAV

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 49 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49816a8397e134d8fc34c2c8d004912a.exe
    "C:\Users\Admin\AppData\Local\Temp\49816a8397e134d8fc34c2c8d004912a.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Users\Admin\beaef.exe
      "C:\Users\Admin\beaef.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4672

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\beaef.exe

          Filesize

          144KB

          MD5

          2d4055ccd3bcb3a171a32a1a545afab7

          SHA1

          0faedb0c483b2953f2492ca8568f3d335a1e24b3

          SHA256

          12309124075add4ba6699ef565cfe1c38fb0c0d2725f2e160605fba4a976073f

          SHA512

          26304b1d14fb26d1091d17c5949f25bd57ff345c42754d651261ce336068b4698ee92f34dc9152e986cd4ee681a8cf1db1d69242dd3814dec1fc212502622b04