Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 03:41
Static task
static1
Behavioral task
behavioral1
Sample
4a58343be43aabd8208f96368dd71d4a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4a58343be43aabd8208f96368dd71d4a.exe
Resource
win10v2004-20231215-en
General
-
Target
4a58343be43aabd8208f96368dd71d4a.exe
-
Size
201KB
-
MD5
4a58343be43aabd8208f96368dd71d4a
-
SHA1
0effc69355fd92c7e323636ba69cdcc52f8acbcd
-
SHA256
31eacd3117d660daf79e221ac449d77b7bb8f216871cc749ade733361b307c04
-
SHA512
046a9119960e5651b4061e21cb6450520c3f920dcc5616ee211c36e5143a84e9add025b94181e3032799053e243122f3a8a5c5d21d4f9ba68127fd067edc7368
-
SSDEEP
3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B8epjBFy11AwA:o68i3odBiTl2+TCU/lhuhuIc
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart" 4a58343be43aabd8208f96368dd71d4a.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\SHARE_TEMP\Icon7.ico 4a58343be43aabd8208f96368dd71d4a.exe File created C:\Windows\SHARE_TEMP\Icon12.ico 4a58343be43aabd8208f96368dd71d4a.exe File created C:\Windows\SHARE_TEMP\Icon14.ico 4a58343be43aabd8208f96368dd71d4a.exe File created C:\Windows\winhash_up.exez 4a58343be43aabd8208f96368dd71d4a.exe File created C:\Windows\SHARE_TEMP\Icon3.ico 4a58343be43aabd8208f96368dd71d4a.exe File created C:\Windows\SHARE_TEMP\Icon5.ico 4a58343be43aabd8208f96368dd71d4a.exe File created C:\Windows\SHARE_TEMP\Icon6.ico 4a58343be43aabd8208f96368dd71d4a.exe File created C:\Windows\bugMAKER.bat 4a58343be43aabd8208f96368dd71d4a.exe File opened for modification C:\Windows\winhash_up.exez 4a58343be43aabd8208f96368dd71d4a.exe File created C:\Windows\winhash_up.exe 4a58343be43aabd8208f96368dd71d4a.exe File created C:\Windows\SHARE_TEMP\Icon2.ico 4a58343be43aabd8208f96368dd71d4a.exe File created C:\Windows\SHARE_TEMP\Icon10.ico 4a58343be43aabd8208f96368dd71d4a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1712 cmd.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4380 wrote to memory of 1712 4380 4a58343be43aabd8208f96368dd71d4a.exe 18 PID 4380 wrote to memory of 1712 4380 4a58343be43aabd8208f96368dd71d4a.exe 18 PID 4380 wrote to memory of 1712 4380 4a58343be43aabd8208f96368dd71d4a.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a58343be43aabd8208f96368dd71d4a.exe"C:\Users\Admin\AppData\Local\Temp\4a58343be43aabd8208f96368dd71d4a.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:1712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76B
MD5624c0b02fc3786bc1fe11308fa5c4b9d
SHA1aeeef34030f30a6363b3e6669fb2a78214329fda
SHA2569cdd23f204c83a989bd8ff8c3b6db08e1da0d9cd759ca0b69147d03aa8ca634c
SHA512724db6ded73c24b015330f1ce44778eaecebac235ac13db4fd99a43c841cfe57b5e4f2839418929def4236c6996e63f91126b0f54b52c4f1dd54be54a2c9379c