Analysis

  • max time kernel
    139s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/01/2024, 03:41

General

  • Target

    4a58343be43aabd8208f96368dd71d4a.exe

  • Size

    201KB

  • MD5

    4a58343be43aabd8208f96368dd71d4a

  • SHA1

    0effc69355fd92c7e323636ba69cdcc52f8acbcd

  • SHA256

    31eacd3117d660daf79e221ac449d77b7bb8f216871cc749ade733361b307c04

  • SHA512

    046a9119960e5651b4061e21cb6450520c3f920dcc5616ee211c36e5143a84e9add025b94181e3032799053e243122f3a8a5c5d21d4f9ba68127fd067edc7368

  • SSDEEP

    3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B8epjBFy11AwA:o68i3odBiTl2+TCU/lhuhuIc

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a58343be43aabd8208f96368dd71d4a.exe
    "C:\Users\Admin\AppData\Local\Temp\4a58343be43aabd8208f96368dd71d4a.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4380
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      PID:1712

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\bugMAKER.bat

          Filesize

          76B

          MD5

          624c0b02fc3786bc1fe11308fa5c4b9d

          SHA1

          aeeef34030f30a6363b3e6669fb2a78214329fda

          SHA256

          9cdd23f204c83a989bd8ff8c3b6db08e1da0d9cd759ca0b69147d03aa8ca634c

          SHA512

          724db6ded73c24b015330f1ce44778eaecebac235ac13db4fd99a43c841cfe57b5e4f2839418929def4236c6996e63f91126b0f54b52c4f1dd54be54a2c9379c

        • memory/4380-24-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB