Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/02/2024, 04:20

General

  • Target

    a0ee287caf739fd852681ecb4b4572f5.exe

  • Size

    49KB

  • MD5

    a0ee287caf739fd852681ecb4b4572f5

  • SHA1

    3438f0efc2489397896862580afb463402879044

  • SHA256

    a41298f558400373e01f055e445bab5bf5c18668bcc7af4ec767c807a1e1b077

  • SHA512

    d64f588edc73e8a2f1b2df2bb76c43342daa3a460914425a6119d1cae7ad401ba0ead0cedf223a0befc314854880b1244adde494bc0f9ea5dc87f8da65c62458

  • SSDEEP

    1536:GQ6PzGTQ5arL5CXlPg8Llob9wxQhADbdAEvg:b6bG80H5CXXLlOO+hWbdpI

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3396
      • C:\Users\Admin\AppData\Local\Temp\a0ee287caf739fd852681ecb4b4572f5.exe
        "C:\Users\Admin\AppData\Local\Temp\a0ee287caf739fd852681ecb4b4572f5.exe"
        2⤵
        • Checks computer location settings
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4636
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" C:\Windows\system32\SafeSearch.dll /u /s
          3⤵
            PID:1868
          • C:\program files (x86)\common files\system\ms1src.exe
            "C:\program files (x86)\common files\system\ms1src.exe" -kill c:\users\admin\appdata\local\temp\a0ee287caf739fd852681ecb4b4572f5.exe /install
            3⤵
            • Checks computer location settings
            • Deletes itself
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4080
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" C:\Windows\system32\SafeSearch.dll /u /s
              4⤵
                PID:1548

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Common Files\System\ms1src.exe

                Filesize

                49KB

                MD5

                a0ee287caf739fd852681ecb4b4572f5

                SHA1

                3438f0efc2489397896862580afb463402879044

                SHA256

                a41298f558400373e01f055e445bab5bf5c18668bcc7af4ec767c807a1e1b077

                SHA512

                d64f588edc73e8a2f1b2df2bb76c43342daa3a460914425a6119d1cae7ad401ba0ead0cedf223a0befc314854880b1244adde494bc0f9ea5dc87f8da65c62458

              • memory/4080-14-0x00000000004B0000-0x00000000004B2000-memory.dmp

                Filesize

                8KB

              • memory/4080-15-0x0000000000400000-0x000000000042E000-memory.dmp

                Filesize

                184KB

              • memory/4636-0-0x0000000000400000-0x000000000042E000-memory.dmp

                Filesize

                184KB

              • memory/4636-1-0x00000000009D0000-0x00000000009D2000-memory.dmp

                Filesize

                8KB

              • memory/4636-13-0x0000000000400000-0x000000000042E000-memory.dmp

                Filesize

                184KB