f6155c46c72a298d24981504934dd96202b2379b2d05fce81043254bab07b2d6

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7d4e211b765f2bfb2448adde3ae4ee73.exe
Size

242KB
MD5

7d4e211b765f2bfb2448adde3ae4ee73
SHA1

4b760746721049c99d78847912a44f19bb14f03e
SHA256

f6155c46c72a298d24981504934dd96202b2379b2d05fce81043254bab07b2d6
SHA512

9132d0d90110a73544f6d7c2e5294318c947e3989b5b3175910512bfe0755017c7d1a8341ab79180565a4f8f1ab54191b4ed5f9952c9693dbaef97ea7d49ee78
SSDEEP

3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/e8rkgnYHfQlAo:o68i3odBiTl2+TCU/Bk8KfQlE3k

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart"	7d4e211b765f2bfb2448adde3ae4ee73.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SHARE_TEMP\Icon3.ico	7d4e211b765f2bfb2448adde3ae4ee73.exe
File created	C:\Windows\SHARE_TEMP\Icon5.ico	7d4e211b765f2bfb2448adde3ae4ee73.exe
File created	C:\Windows\SHARE_TEMP\Icon12.ico	7d4e211b765f2bfb2448adde3ae4ee73.exe
File created	C:\Windows\winhash_up.exez	7d4e211b765f2bfb2448adde3ae4ee73.exe
File created	C:\Windows\SHARE_TEMP\Icon2.ico	7d4e211b765f2bfb2448adde3ae4ee73.exe
File created	C:\Windows\SHARE_TEMP\Icon6.ico	7d4e211b765f2bfb2448adde3ae4ee73.exe
File created	C:\Windows\SHARE_TEMP\Icon7.ico	7d4e211b765f2bfb2448adde3ae4ee73.exe
File created	C:\Windows\SHARE_TEMP\Icon10.ico	7d4e211b765f2bfb2448adde3ae4ee73.exe
File created	C:\Windows\SHARE_TEMP\Icon14.ico	7d4e211b765f2bfb2448adde3ae4ee73.exe
File created	C:\Windows\bugMAKER.bat	7d4e211b765f2bfb2448adde3ae4ee73.exe
File opened for modification	C:\Windows\winhash_up.exez	7d4e211b765f2bfb2448adde3ae4ee73.exe
File created	C:\Windows\winhash_up.exe	7d4e211b765f2bfb2448adde3ae4ee73.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4904	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 4904	3676	7d4e211b765f2bfb2448adde3ae4ee73.exe	85
PID 3676 wrote to memory of 4904	3676	7d4e211b765f2bfb2448adde3ae4ee73.exe	85
PID 3676 wrote to memory of 4904	3676	7d4e211b765f2bfb2448adde3ae4ee73.exe	85

C:\Users\Admin\AppData\Local\Temp\7d4e211b765f2bfb2448adde3ae4ee73.exe
"C:\Users\Admin\AppData\Local\Temp\7d4e211b765f2bfb2448adde3ae4ee73.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\bugMAKER.bat

Filesize
76B

MD5
df99c52bd91eb403f3b62035c264ffeb

SHA1
f7c4afe3731ba9996df66533740828509c5b2046

SHA256
e47da6163e68ee6f1b21c206e61fd2c88f13ed96d31d4239127a1dd8d4300196

SHA512
6aa905a8dea4e572ae158f475fce58fa7b2289eb5e8da52a738e0ae2049ac8ede24721ec6a117f52f28244c0bffdcde8af3a7b9933dea46f8fbb1361c376f4c5

Download Submit
memory/3676-24-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads