3b3aeb211e94f51e5f33329e5b5d949a1fcf905f55912ad65e8826e162269665

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e7606fc748735d244e8c0155851a0da.exe
Size

255KB
MD5

4e7606fc748735d244e8c0155851a0da
SHA1

b79a602372110d56e41fb8848b859d634e25c2ac
SHA256

3b3aeb211e94f51e5f33329e5b5d949a1fcf905f55912ad65e8826e162269665
SHA512

c83928afcb31ec496bf3c9cac126ce1ad99781be867648418c659134a57a991a10d47b9558aedde7413573fec83e1b1a24b7c70c399eb5caed454a12ff4d58a2
SSDEEP

3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/k8ZtkaVpjBFyi:o68i3odBiTl2+TCU/5tk8huhuIpRL5uP

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart"	4e7606fc748735d244e8c0155851a0da.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\winhash_up.exez	4e7606fc748735d244e8c0155851a0da.exe
File opened for modification	C:\Windows\winhash_up.exez	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\SHARE_TEMP\Icon6.ico	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\SHARE_TEMP\Icon12.ico	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\SHARE_TEMP\Icon10.ico	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\SHARE_TEMP\Icon14.ico	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\bugMAKER.bat	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\winhash_up.exe	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\SHARE_TEMP\Icon2.ico	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\SHARE_TEMP\Icon3.ico	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\SHARE_TEMP\Icon5.ico	4e7606fc748735d244e8c0155851a0da.exe
File created	C:\Windows\SHARE_TEMP\Icon7.ico	4e7606fc748735d244e8c0155851a0da.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
652	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 652	2068	4e7606fc748735d244e8c0155851a0da.exe	18
PID 2068 wrote to memory of 652	2068	4e7606fc748735d244e8c0155851a0da.exe	18
PID 2068 wrote to memory of 652	2068	4e7606fc748735d244e8c0155851a0da.exe	18

C:\Users\Admin\AppData\Local\Temp\4e7606fc748735d244e8c0155851a0da.exe
"C:\Users\Admin\AppData\Local\Temp\4e7606fc748735d244e8c0155851a0da.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  PID:652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\bugMAKER.bat

Filesize
76B

MD5
9b99cae44d58e5cb6332e5a03e9f6043

SHA1
9b538de68e19226403c5735dee987bedf236056b

SHA256
b8edf4c31099124539998aafbe140a974f4678f80b369096e2f0d65331dcaa41

SHA512
91fb42cc1a849cee35b8f443fd19c2214055f8dfd3dfd9499a25bbeca13ad38de0dead97f9ab56dd5157f9c653ba08f0efbad6f63ad1eefdd63660aaf4a0c5c1

Download Submit
memory/2068-24-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads