Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
19/02/2024, 16:36
General
-
Target
b0f79cc681ff3a9873d3f2865de774982d8dc691e1cd33e79e18b226aeeb9416.exe
-
Size
4.5MB
-
MD5
97208007ab21ffc52c7cc01445e04fdf
-
SHA1
907515ad2fc262e4ddc5161703bfdd28163f2e0c
-
SHA256
b0f79cc681ff3a9873d3f2865de774982d8dc691e1cd33e79e18b226aeeb9416
-
SHA512
d0c4c087ee2164cfd064833fad70cb6dd7e665a8fdda44c67557e5b3f3ea1fac6f17fdc51a2b8e6e532d1823bc45910b1ea2fd7fede9bc12dcd467053867d66f
-
SSDEEP
98304:p8CWEft+AGpoPdmjfwn706B9w6rMkZFbyNQ1Ue43PZ5fMXy/1Q:OZEF+5lu7PJrWN+4B57/1Q
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 37 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0f79cc681ff3a9873d3f2865de774982d8dc691e1cd33e79e18b226aeeb9416.exe"C:\Users\Admin\AppData\Local\Temp\b0f79cc681ff3a9873d3f2865de774982d8dc691e1cd33e79e18b226aeeb9416.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\kaidisoft\changweici\b0f79cc681ff3a9873d3f2865de774982d8dc691e1cd33e79e18b226aeeb9416.exe"C:\kaidisoft\changweici\b0f79cc681ff3a9873d3f2865de774982d8dc691e1cd33e79e18b226aeeb9416.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD57c5c1f4534da903c09ea29940c2eea5a
SHA148a7c4ea0b344aafd55a8f107665ae7e6494ed5b
SHA256d42954389fba1686b378bb4041f1b5c60e06c71ba777af043cbf5f8610825867
SHA512507b0c440fac640b6f157f3b0e2db82de9d1874b7d9578946699788c554651d10760e2401342c4d8493e59ec7f213a658e46e0fe50ef7cf17fbe6cf033e5dbab
-
Filesize
1.1MB
MD5050de54019185fe29fb7f1135ccc1677
SHA152cb951dc2359bb90f556824f56f3db57b785e4f
SHA256d4914b9c63f0d22e9179fd879b20f5294fe80e2703902cbde68ac83dcb68bac7
SHA512900ad515becaa5938ba92fb5d9f7d09c6b9bcb2c7d50965d99e75287ae6eea1efb11960cb00877ae211c22f592386e4029580c0619697292a80428dc3b52a7ee
-
Filesize
3.4MB
MD5e8c5470d42062dd7af01f67cc7c396fd
SHA1a63234c9a2acaab54485841d4fb05d1f589c57d9
SHA2569039d3eef9f8dc6eda9e29408f5affc559c2ca957cbbaf8974e7653ea92203b6
SHA512d987b72aecd908326ea428a524d31e7dd89fc50b875bc8305a7eb33fde280799be0a2244a73092acba19f0736f115c7e7bdfb5ee89fb0b6b8a03e81e24c9bb6b
-
Filesize
3.3MB
MD5e48b236716fce7d1316ce2eef9f85f11
SHA196561202a76bc22cfcc8734833045e76fd9e32b3
SHA256c735f4255cba58c20e1c0a06b89563e7bd0eae0d87953dbdeeff4162476a7d92
SHA51295cc61de1ed79581c9e54e71049bd2dd65e7e3c7fbbf0bd893a314693f4ff7616c1f55c900df188cc51316cc056a7c3aa495ba9b07d51e9bbe5eed0f4c2f242c
-
Filesize
2.3MB
MD515cf65daf938970d59c7cf19d93c1d90
SHA11ea759bb24e66752176279f523f9a99d6a546e6d
SHA256471ea0558972f059d0a0fb3a70bcd1cf8b459a90186d57eaa7418ce9e5540acd
SHA5120c8376d29badd64cd62208aa7174bf2d39be1fd8929bc4dc63f44df4920c762cee2f9c69a38a414c1e5b49e29752387fd69d1a2af6949c644e11285b3336ad33
-
Filesize
3.0MB
MD5d38fb44df68c4b1d0ef27ad3a668f35e
SHA1fe870176309e48559d9f86686500395b76137803
SHA256cd685f11465a01705bda655d9776fb452f505a8dbe4fd5ee4af89b650f7171fb
SHA512ba67d5bdcc31eabd4a7872f9d4aa621ab7bd61e56be182ce95cbfacd8c151d3e227ecc772bef868e51d778fa989c842baf59e3dfad2ef6820be851e936df8ae1
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.4MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
1.6MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.4MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.4MB
-
Filesize
6.4MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
1.6MB
-
Filesize
248KB
-
Filesize
6.4MB
-
Filesize
6.4MB
-
Filesize
6.4MB