Analysis

  • max time kernel
    143s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-01-2024 08:01

General

  • Target

    71b2f3c40cf873641f39dde41d160c6a.exe

  • Size

    608KB

  • MD5

    71b2f3c40cf873641f39dde41d160c6a

  • SHA1

    ca0aa9c6e5be1fba93ca3a5da3ed01584f3c9495

  • SHA256

    046a1ab07d00310dfdbb8390f614bf3cd90aad379c5c713fc62889ea72792335

  • SHA512

    1ed5e3b99974e434494d952e65df913dd6dfd599fd08161a024489e8efed78c04facaa91473124b8179f6db97c58186e0b962840f2ba511bf74f9083994fa87e

  • SSDEEP

    12288:72KXHc77k5zsOn91Sbj+1+rG1Bhdk6b4LsXbqFVZguy1ukVLoGERBo2:72KXeCz7I+1GMdkVTcv1VVKt

Score
8/10

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71b2f3c40cf873641f39dde41d160c6a.exe
    "C:\Users\Admin\AppData\Local\Temp\71b2f3c40cf873641f39dde41d160c6a.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3748
    • C:\Users\Admin\AppData\Local\240609875.exe
      C:\Users\Admin\AppData\Local\240609875.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1128
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\dencrcs.dll",Startup
        3⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\dencrcs.dll",iep
          4⤵
          • Loads dropped DLL
          PID:4444
    • C:\Users\Admin\AppData\Local\240609876.exe
      C:\Users\Admin\AppData\Local\240609876.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1032
      • C:\Users\Admin\AppData\Local\Temp\lnUMnIoxFh.exe
        "C:\Users\Admin\AppData\Local\Temp\lnUMnIoxFh.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3720
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3560

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    2
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\240609875.exe
      Filesize

      47KB

      MD5

      72efb4367c308091de41bae5f4609d5a

      SHA1

      e189e9b85c9cab64d2372271a890bf22ae65d66c

      SHA256

      b24969a114d5b8b0d2246e73501d620d61a492fe2894ec7e34a9542e3e7b2597

      SHA512

      02f51100c9cf5ac396f411973c62ac3920395bb47a82f70b8f4881f2778e215728c1ce218b2d128a46078563081b27ac4db13e833fee1f5e9a9594a57a9f430f

    • C:\Users\Admin\AppData\Local\240609875.exe
      Filesize

      12KB

      MD5

      91a85b15ee01ced34a05442759b5d3fc

      SHA1

      1b14d3c7e1707f330ee2b29c365ab2b5ef8d242c

      SHA256

      3dbde8b7d743e59da6e8992ef5dc55f42629273c32a0addf347642806ea0b302

      SHA512

      83ddc431c2bbb35cd35521ac19397feac32706834a777cdd2cdd98b6d3958022649243822ea6720b00dfb9b1819ce716dd52d9222f368b66589d769b10d07c78

    • C:\Users\Admin\AppData\Local\240609876.exe
      Filesize

      6KB

      MD5

      c7c3d606bc986cab8087aa5683b4ca9b

      SHA1

      0569215e4566fb4e441aa78372c62d107f10325a

      SHA256

      15241f2831bb9951219538d247cecc67340fee4a45d06d750dfaa699d5af5925

      SHA512

      edd3f75b1d49bda5572168b37c2f64ff9c2bea8ac0873c9432b306a55ee974176879a03fb221969298e48c5130b2f3e22623f37473269d38421258a90cbd8389

    • C:\Users\Admin\AppData\Local\240609876.exe
      Filesize

      459KB

      MD5

      80938190ace75411254ff102f397a02d

      SHA1

      ffea9db9ef85e1781c811b224a3abf708c05e2e4

      SHA256

      11983799b400aad459d846735c178d8d9a9cd9819a63b11eadf83e0c48ef51c7

      SHA512

      9c8dc6918efcc1684a5c2577b07584c65f4f33e223e3dbf5e63aa9c111a56ca1686e21363bb29831a28c7f7fb65d2263f5325a78cbde5097e6bd1eb9750210b2

    • C:\Users\Admin\AppData\Local\Temp\DOTQjGgjsJ.dll
      Filesize

      300KB

      MD5

      4050d2d7856f89e3f09b1b1792a9caec

      SHA1

      14bf254303227540dcee3905ce8e5b294bf67a28

      SHA256

      c3adee19e5347f23a4c3c0ea134bbcbf80411b468c5183aeb95be7206919acc9

      SHA512

      937505accdad98388b0027807dff603c78dfb481f1ba5bb78f3a4885ecfc4ebb60ff5261c175caccaa7d60a208d935378941260e29d3d7f8e9930f884ed89f8d

    • C:\Users\Admin\AppData\Local\dencrcs.dll
      Filesize

      88KB

      MD5

      6c99f1d251b1891ca95e1ffbada7ce7c

      SHA1

      6ae72d1ca54dc5ff28727703fb63482594c585ce

      SHA256

      2c6944dfcee1c10e5070e6e2432373f94b0f86ec48f31a642eeabc75bde1e87b

      SHA512

      1a474407816bb48e74fd27854cba86353b0d9cbb2f1ae53f358b40c9ae04e367bb18a5634172a74e7a922b867b610b7257d56fa1984ece7c6879d30914796af5

    • memory/1032-17-0x00000000021D0000-0x0000000002240000-memory.dmp
      Filesize

      448KB

    • memory/1032-36-0x0000000000400000-0x0000000000565000-memory.dmp
      Filesize

      1.4MB

    • memory/1032-18-0x0000000000400000-0x0000000000565000-memory.dmp
      Filesize

      1.4MB

    • memory/1128-13-0x0000000002220000-0x0000000002230000-memory.dmp
      Filesize

      64KB

    • memory/1128-40-0x0000000002220000-0x0000000002230000-memory.dmp
      Filesize

      64KB

    • memory/1128-12-0x0000000002220000-0x0000000002230000-memory.dmp
      Filesize

      64KB

    • memory/1128-41-0x0000000002220000-0x0000000002230000-memory.dmp
      Filesize

      64KB

    • memory/1128-37-0x0000000010000000-0x0000000010016000-memory.dmp
      Filesize

      88KB

    • memory/1128-11-0x0000000010000000-0x0000000010016000-memory.dmp
      Filesize

      88KB

    • memory/2740-56-0x0000000010000000-0x0000000010016000-memory.dmp
      Filesize

      88KB

    • memory/2740-44-0x0000000002210000-0x0000000002220000-memory.dmp
      Filesize

      64KB

    • memory/2740-38-0x0000000010000000-0x0000000010016000-memory.dmp
      Filesize

      88KB

    • memory/2740-50-0x0000000010000000-0x0000000010016000-memory.dmp
      Filesize

      88KB

    • memory/2740-22-0x0000000002210000-0x0000000002220000-memory.dmp
      Filesize

      64KB

    • memory/2740-23-0x0000000002210000-0x0000000002220000-memory.dmp
      Filesize

      64KB

    • memory/2740-43-0x0000000002210000-0x0000000002220000-memory.dmp
      Filesize

      64KB

    • memory/2740-21-0x0000000010000000-0x0000000010016000-memory.dmp
      Filesize

      88KB

    • memory/3720-39-0x0000000000400000-0x0000000000565000-memory.dmp
      Filesize

      1.4MB

    • memory/3748-0-0x00000000024A0000-0x00000000024B0000-memory.dmp
      Filesize

      64KB

    • memory/3748-2-0x0000000000400000-0x0000000000498000-memory.dmp
      Filesize

      608KB

    • memory/3748-1-0x00000000024A0000-0x00000000024B0000-memory.dmp
      Filesize

      64KB

    • memory/4444-53-0x0000000002B50000-0x0000000002B60000-memory.dmp
      Filesize

      64KB

    • memory/4444-52-0x0000000002B50000-0x0000000002B60000-memory.dmp
      Filesize

      64KB

    • memory/4444-58-0x0000000010000000-0x0000000010016000-memory.dmp
      Filesize

      88KB

    • memory/4444-63-0x0000000002B50000-0x0000000002B60000-memory.dmp
      Filesize

      64KB

    • memory/4444-64-0x0000000002B50000-0x0000000002B60000-memory.dmp
      Filesize

      64KB