Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26-01-2024 06:18
General
-
Target
769c636028a46cc6c0253aa1562e70c2.exe
-
Size
2.0MB
-
MD5
769c636028a46cc6c0253aa1562e70c2
-
SHA1
8f93e67af9be7fd65733ffe5f337b48f4d57d8ed
-
SHA256
4e712c8121888ca675e9a21f3dccb7af45b711077e02cf16e8447541e339edc6
-
SHA512
1c675f9efe43aca35941ad540ea686b98ac4b01e271a9f828c04d8e156a2d2f29e875aceb796fe602ff38be3da628dc59801d283797793c2c7674672f66b75a4
-
SSDEEP
49152:OFUcx88PWPOpX0SFGcDSHbRDc63d8uP2l1fH/f7wj+3aDyGc:O+K88uPCHlkRD73OuPQ/f7qPyGc
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\769c636028a46cc6c0253aa1562e70c2.exe"C:\Users\Admin\AppData\Local\Temp\769c636028a46cc6c0253aa1562e70c2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp" --splashC:\Users\Admin\AppData\Local\Temp\769c636028a46cc6c0253aa1562e70c2.exe F3A5DE96E507AD348C4F74021701C0771F1D4B72DEC6ACB176A59CFFCC3ACBFBC52C18706B361C090CE5D39F6F86650E4B7A66CC6D23CB661DC059773869E8E12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\769c636028a46cc6c0253aa1562e70c2.docx" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
793KB
MD5f0a3f566e6969392ca6e5cfe7d6a2a6d
SHA1621a76be24d15426cd3f9c44f4731ad061e0c4a9
SHA2563315fb5407a350fef4204d6c24412a3fafa191e8cbf9c42fd04b2080f66dc2fa
SHA512b354b09835b3b43690dc278d2652e26c951172d6ff57fe560ed3055d8af158d745bc675589f75d068224fc77daaea8f1c7d445c3bd3f515649897e20bc018f49
-
Filesize
1.2MB
MD502b477c2387136061f38de1c27ec92cf
SHA1c5344fc6342fbfbe2d2589b66583e24e2aae965b
SHA256845672da3d5005ae97ca69b06ed51da7d0d385b5793af3b9ec7534a84ebe377e
SHA512ab42987edb4356e88a724ab8f10a4ba4fedfab02052907410c20de19164ec96779e31406bd1159382131bc6ab359c9be7f58579cd4dd73f5ae8177de20cdc4c8
-
Filesize
19KB
MD54046ff080673cffac6529512b8d3bdbb
SHA1d3cbc39065b7a55e995fa25397da2140bdac80c1
SHA256f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
SHA512453f70730b7560e3d3e23ddfa0fe74e014753f8b34b45254c1c0cf5fec0546a2b8b109a4f9d096e91711b6d02cb383a7136c2cb7bd6600d0598acf7c90c25418
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB