Overview

overview

8

Static

static

3

electronex...26.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    295s
  • max time network
    270s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/01/2024, 18:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    electronexecutor_48426.exe

  • Size

    2.7MB

  • MD5

    47c6248c61d27d2aac02299568dad8f5

  • SHA1

    87d5d2b6b9e7b6f7fdd316eb500987fbf8cd13f0

  • SHA256

    7161051f2cda2f3184ea630735ddb9929951d324dae53860b08f540eebcb5c43

  • SHA512

    38270f6fd07749740deefe4ba1bdf6b5ff6209a7bbb9bc05d027d3071b8ec1697186d0bbfe5384d4626673249a760d67db64e9bea6e5859ccdf1c0550aadddc2

  • SSDEEP

    49152:7kQqe5vs+HbhCc7YvgLPkLUX0FilDCIr1QN/Way:7kQqeJs+HbhF7YvMvUiMI+Oh

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\electronexecutor_48426.exe
    "C:\Users\Admin\AppData\Local\Temp\electronexecutor_48426.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4992
    • C:\Program Files (x86)\SPARKFullcaiApplication\SPARKcApplication.exe
      "C:\Program Files (x86)\SPARKFullcaiApplication\SPARKcApplication.exe"
      2⤵
      • Executes dropped EXE
      • Registers COM server for autorun
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2572
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2068

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\SPARKFullcaiApplication\SPARKcApplication.exe
            Filesize

            1.5MB

            MD5

            a6a0f7c173094f8dafef996157751ecf

            SHA1

            c0dcae7c4c80be25661d22400466b4ea074fc580

            SHA256

            b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

            SHA512

            965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

            Download Submit

          • C:\Program Files\7-Zip\7-zip.dll
            Filesize

            92KB

            MD5

            c3af132ea025d289ab4841fc00bb74af

            SHA1

            0a9973d5234cc55b8b97bbb82c722b910c71cbaf

            SHA256

            56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

            SHA512

            707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

            Download Submit

          • memory/4992-0-0x0000000010000000-0x000000001008D000-memory.dmp

            Filesize

            564KB

            Download