Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2024, 03:15

General

  • Target

    8e13902e125d572d7c58f6783346dbae.exe

  • Size

    132KB

  • MD5

    8e13902e125d572d7c58f6783346dbae

  • SHA1

    5361b8c8a943f00163b32090805cc129f3e5b3f4

  • SHA256

    9311f3d36f3369ff70d5466e688f7b4640627d13485cd361c342737d3c9b8c49

  • SHA512

    17abf9cb83c84d66886e9ec38c8e7ee97f7de0cffa357df022381170265248ea480e73462b899e60e0ef4501835043690f8d67fd60a3a70926cc79b7cf58ad50

  • SSDEEP

    3072:qAp5bM+xspX7//GSeIlLXkskMvB00bsMyXeWLkr:qApSI+7//leIBXTkMZ00bsMyXeAk

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e13902e125d572d7c58f6783346dbae.exe
    "C:\Users\Admin\AppData\Local\Temp\8e13902e125d572d7c58f6783346dbae.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3600
    • C:\Users\Admin\fuiewat.exe
      "C:\Users\Admin\fuiewat.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4144

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\fuiewat.exe

    Filesize

    132KB

    MD5

    e3e739e20d00bb6747919bfaa24183d4

    SHA1

    4e16373bf90d5f6b2c1a09c1b39b65f32c26af96

    SHA256

    ca03c04abf3d65bbb7774d8e4a703dea08b4176649e09522ad505ae539c1982e

    SHA512

    aad009c20be5d2dccfe7f94c8d28ebd469fd7f70ebc38b14862abccf7f811a0a05f1467b3841e04a63096c6bf75b989622783177437660054d457b7f1ba69c23