Analysis
- max time kernel
0s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
07/01/2024, 19:37
General
- Target a748a2c1309b46e221d69642e5ae7e31.exe
- Size 1.4MB
- Sample240107-yb2ypadfb4
- SHA256 685879a8ac253907b3eefd0f5b92d3380fb2fa3a6c4d1cc02d42d6591cc10165
Malware Config
Signatures
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry key 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a748a2c1309b46e221d69642e5ae7e31.exe"C:\Users\Admin\AppData\Local\Temp\a748a2c1309b46e221d69642e5ae7e31.exe"1⤵
-
C:\Users\Admin\Documents\a748a2c1309b46e221d69642e5ae7e31.exe"C:\Users\Admin\Documents\a748a2c1309b46e221d69642e5ae7e31.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f1⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f1⤵
-
C:\ProgramData\ciepsIdenxsWlFYrmbHQRPUFyGjwvMQSKjyqbJLgJNblGUHtUq\ciepsIdenxsWlFYrmbHQRPUFyGjwvMQSKjyqbJLgJNblGUHtUq\0.0.0.0\screen.exe"C:\ProgramData\ciepsIdenxsWlFYrmbHQRPUFyGjwvMQSKjyqbJLgJNblGUHtUq\ciepsIdenxsWlFYrmbHQRPUFyGjwvMQSKjyqbJLgJNblGUHtUq\0.0.0.0\screen.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1196-1-0x0000000001A40000-0x0000000001A50000-memory.dmp
memory/1196-2-0x0000000075580000-0x0000000075B31000-memory.dmp
memory/1196-0-0x0000000075580000-0x0000000075B31000-memory.dmp
memory/1196-17-0x0000000075580000-0x0000000075B31000-memory.dmp
memory/1332-87-0x0000000001300000-0x0000000001310000-memory.dmp
memory/1332-108-0x0000000001300000-0x0000000001310000-memory.dmp
memory/1332-51-0x0000000075580000-0x0000000075B31000-memory.dmp
memory/1332-85-0x0000000001300000-0x0000000001310000-memory.dmp
memory/1332-834-0x0000000001300000-0x0000000001310000-memory.dmp
memory/1332-832-0x0000000001300000-0x0000000001310000-memory.dmp
memory/1332-833-0x0000000001300000-0x0000000001310000-memory.dmp
memory/1332-831-0x0000000075580000-0x0000000075B31000-memory.dmp
memory/1332-830-0x0000000001300000-0x0000000001310000-memory.dmp
memory/1332-829-0x0000000075580000-0x0000000075B31000-memory.dmp
memory/1332-50-0x0000000075580000-0x0000000075B31000-memory.dmp
memory/2364-106-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-73-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-83-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-86-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-93-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-97-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-102-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-109-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-117-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-119-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-115-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-113-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-111-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-75-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-104-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-99-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-95-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-91-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-89-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-81-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-77-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-79-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-71-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-69-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-67-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-63-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-53-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-52-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-29-0x0000000000D10000-0x0000000000D20000-memory.dmp
memory/2364-65-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-822-0x0000000000D10000-0x0000000000D20000-memory.dmp
memory/2364-823-0x0000000000D10000-0x0000000000D20000-memory.dmp
memory/2364-826-0x0000000075580000-0x0000000075B31000-memory.dmp
memory/2364-827-0x0000000000D10000-0x0000000000D20000-memory.dmp
memory/2364-828-0x0000000075580000-0x0000000075B31000-memory.dmp
memory/2364-61-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-59-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-57-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-55-0x0000000006360000-0x00000000063E4000-memory.dmp
memory/2364-30-0x0000000075580000-0x0000000075B31000-memory.dmp
memory/2364-18-0x0000000075580000-0x0000000075B31000-memory.dmp
memory/2364-835-0x0000000000D10000-0x0000000000D20000-memory.dmp
memory/2364-836-0x0000000000D10000-0x0000000000D20000-memory.dmp
memory/2364-837-0x0000000000D10000-0x0000000000D20000-memory.dmp