Analysis

  • max time kernel
    152s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2024, 04:06

General

  • Target

    8b5a798a5aefc7817f4ad1412e69a6ce.exe

  • Size

    291KB

  • MD5

    8b5a798a5aefc7817f4ad1412e69a6ce

  • SHA1

    cef0d699332025e8da7fe747eb69346be932cb9d

  • SHA256

    36bcbc6f042482039ffd4e6f5c4c83ce5b86394da2506670b86d3d7525f79549

  • SHA512

    0af6f31e22c82890d5e81424fa2ff7a47d2c98e43d5d3ba4541c045920a536158cdc080f32194ccfb84d1e802be3e5192e5d0bdeb89740fcadca33bf08fefafd

  • SSDEEP

    768:crKFygpFRA/vMHTi9bDoMVpb0mjv8gx5poyKcMYocg3arRw:uKFygOnYi9bRVBjv8YoyIYxgy

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b5a798a5aefc7817f4ad1412e69a6ce.exe
    "C:\Users\Admin\AppData\Local\Temp\8b5a798a5aefc7817f4ad1412e69a6ce.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:740
    • C:\Users\Admin\AppData\Local\Temp\Payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      PID:3252
    • C:\Windows\SysWOW64\attrib.exe
      attrib +h +r +s "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
      2⤵
      • Views/modifies file attributes
      PID:4072

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Payload.exe

          Filesize

          291KB

          MD5

          8b5a798a5aefc7817f4ad1412e69a6ce

          SHA1

          cef0d699332025e8da7fe747eb69346be932cb9d

          SHA256

          36bcbc6f042482039ffd4e6f5c4c83ce5b86394da2506670b86d3d7525f79549

          SHA512

          0af6f31e22c82890d5e81424fa2ff7a47d2c98e43d5d3ba4541c045920a536158cdc080f32194ccfb84d1e802be3e5192e5d0bdeb89740fcadca33bf08fefafd

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk

          Filesize

          1KB

          MD5

          371e9f5c5222743275e228f1b3d27fb1

          SHA1

          31b0a7ada0ee8c593d1f7d4b8fa3f830566a5fd6

          SHA256

          5684b6a81a92bef5cd5eb049a0e905dc99e7db95d907443f182614b9b48602f1

          SHA512

          14f203f243e9c69a3b3e1beaf8599d5cd0f18627e446a3beac78cb611bb4259ffb4c47ece4da3d3ff4ee1dd01aa379b081a3548844070d3b7312f56d22ffc78f

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk

          Filesize

          1KB

          MD5

          a0e21c3cda955b529c05da3ebc737559

          SHA1

          7cede9bd6a34b2ddb326c3733057cf76b11e3d45

          SHA256

          b34c6f792079e84046ce8c2049f6f233e6c235f025770a028dfc8d57bc54af8c

          SHA512

          e37365ed423d523ca996460ab7adab0a19923906413d22cccde2f1ce144ea25deef5e1a2a6d3cc8580952ebd58438f36f5eb2cb82348e1e3d126fa248d5fc18a

        • memory/740-5-0x0000000074C80000-0x0000000075231000-memory.dmp

          Filesize

          5.7MB

        • memory/740-7-0x00000000018D0000-0x00000000018E0000-memory.dmp

          Filesize

          64KB

        • memory/740-0-0x0000000074C80000-0x0000000075231000-memory.dmp

          Filesize

          5.7MB

        • memory/740-1-0x0000000074C80000-0x0000000075231000-memory.dmp

          Filesize

          5.7MB

        • memory/740-2-0x00000000018D0000-0x00000000018E0000-memory.dmp

          Filesize

          64KB

        • memory/740-22-0x0000000074C80000-0x0000000075231000-memory.dmp

          Filesize

          5.7MB

        • memory/3252-15-0x0000000074C80000-0x0000000075231000-memory.dmp

          Filesize

          5.7MB

        • memory/3252-16-0x0000000000C70000-0x0000000000C80000-memory.dmp

          Filesize

          64KB

        • memory/3252-24-0x0000000074C80000-0x0000000075231000-memory.dmp

          Filesize

          5.7MB

        • memory/3252-25-0x0000000000C70000-0x0000000000C80000-memory.dmp

          Filesize

          64KB