Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12-01-2024 07:13
General
-
Target
55d113b21fe3fa1dd39a8a191b5505b3.exe
-
Size
100KB
-
MD5
55d113b21fe3fa1dd39a8a191b5505b3
-
SHA1
0a47643029a22a3dd129b9d5da041ac81588daf4
-
SHA256
fe3589591b7db5e97ddb00a32c12038bf6c1096de54d9b9c56b94ab7b42e3c57
-
SHA512
fb56795ce846e38de0e65bf2c208775caf2d9b75c1f6ff9293366e04652b7420acfda2a0e36248e768317c482474da6c62446e6f7477529a0cab042f54fd2cd2
-
SSDEEP
1536:nwW8knkx+OoYWj/bWsVXw6dsJFbzmBB0LOO3z/DPuEs+JUfh0Zok4Plnb7bacWg9:nwankv2asVg6uRm0Jj/yPSQLTPlnba
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 54 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55d113b21fe3fa1dd39a8a191b5505b3.exe"C:\Users\Admin\AppData\Local\Temp\55d113b21fe3fa1dd39a8a191b5505b3.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\exploreruwu.exe"C:\Users\Admin\AppData\Local\Temp\exploreruwu.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\exploreruwu.exe" "exploreruwu.exe" ENABLE1⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5fa3e29948b1d3862c786b460d6ecfe35
SHA17e6906b0530821d4c64595676d5c72e5fc3f91a3
SHA2565c6e12d37b948a8ff7f6e3d407d36aa0bafd1511d5b51d01a273b2fb4352a60a
SHA5126e5f24ab755de0d1ee56788f97528a68b52594d751e3975cf97badbb105337ca95b8481910d2e062068baed6e5630aff5d4c187267312107ef8cd425c07a3bb2
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB