Analysis
-
max time kernel
84s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
15-01-2024 01:26
General
-
Target
5bc68c6b8ce3afa22e67e2bc43b242fd.exe
-
Size
107KB
-
MD5
5bc68c6b8ce3afa22e67e2bc43b242fd
-
SHA1
4cd8f6e1fdb3b2ff6bdb42f0c74f4ac780869d7e
-
SHA256
cb6498cb56a096081d878f72d94cc025faca1dbacd31f0c9d84fc1b6b4e176bb
-
SHA512
6c40d68fbb782a83675dd252424399de471e06ce50d738d8db547198612150fa6e257ef055edd5640a50ca0a60a7672f7828d5f9914900d58287366a2e4c8195
-
SSDEEP
1536:5L/eV0oohJlHH05ndYcW60T6hcZvRdf7Wwt8dPi9qH1HWux6JBPEY+41cJ:8Va/H0LY/Rmhudf7hAZH12ux6/8O+
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 2 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Control Panel 8 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bc68c6b8ce3afa22e67e2bc43b242fd.exe"C:\Users\Admin\AppData\Local\Temp\5bc68c6b8ce3afa22e67e2bc43b242fd.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Checks processor information in registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\.tt6E98.tmp.vbs"2⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:31⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1002B
MD59df700c8f6fd43fac0a89aef04214bbd
SHA16ec8bc6d4041ccf19757757c0da6592469f71c57
SHA2569ab6f2c3cc3965cd05f81d859bdfac3b25a5e70178f61ea677d31987c4e142fd
SHA5128bbcd322f3998c0f7d81884737ca313c1353ac7e3899f168fc8d44eafbe064193353b8b16f92113288ff2102c47623b542861440c414b8acf36d75c4ad645d4d
-
Filesize
59KB
MD5538f9ead95eba12134d95b4fe7082331
SHA1527c50b92b5cededdd5b7e3edda71cb13d108dac
SHA256a416bab39037854c14540edaaf80cff7b5f2e9db31eee235527574e8dedd54e6
SHA5124631ff7cf868348585ee0e26591b95be3ee8b232c7980f5013f4464f285b0fbdef41794c44cb8653d6fb6dc815c0c0a9f4af780bfeb9b23d2f4c3bdc62bf4581
-
Filesize
216KB
-
Filesize
192KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
720KB
-
Filesize
216KB
-
Filesize
192KB