Overview

overview

7

Static

static

3

aaa21892ea...46.exe

windows7-x64

7

aaa21892ea...46.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/02/2024, 01:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    aaa21892ea8927d6e1472da71bf40f46.exe

  • Size

    96KB

  • MD5

    aaa21892ea8927d6e1472da71bf40f46

  • SHA1

    f8dd1a2aabc253ec2d3a8c936c3bef9195c7f694

  • SHA256

    c057706eb7688796e71ad3e296e45e9d96c7654bd67fae914a1cec014ce30f7b

  • SHA512

    672dc9999f37dba11266381ad35486ff14b226d3849abbf59278d1bdc5d2419f7197fb24817e7df869a3d2dd54e1f64e7b058c66caf4e65e8f3c2fab8beddf4d

  • SSDEEP

    1536:gfPYm4toWOARhi383nZiY02YAs+JhCLy/o4tCVI8EtgII5WubvHk0CrJ/:gXYm4to9A283nZiGcSt/o4+4tgR5WgS1

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aaa21892ea8927d6e1472da71bf40f46.exe
    "C:\Users\Admin\AppData\Local\Temp\aaa21892ea8927d6e1472da71bf40f46.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4036
    • C:\Windows\SysWOW64\wininit32.exe
      C:\Windows\system32\wininit32.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:2524
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\r2732.bat" "
      2⤵
        PID:376

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\r2732.bat
            Filesize

            235B

            MD5

            1c2495705d1807de3f2bc5d28ec454f2

            SHA1

            12db532dc9d1ae1ce5cb2d732ec5d55595fa2f02

            SHA256

            2b9d30f2afbf55ef7c6812d9d745efc30fa85767d5b29687573b458446363ca8

            SHA512

            5a3c13ec2b6fa7fe877e3f70ced568fbe0962870aafb7273806d8979fa3f126e289ffd0923586f49e78146e3b07a5908267402f534a7477a988760fb76a094da

            Download Submit

          • C:\Windows\SysWOW64\wininit32.exe
            Filesize

            98KB

            MD5

            d0e72285ad131ba9e71bdf1682d9f71c

            SHA1

            48b248ae3d117dee722433d8096892de4d59f721

            SHA256

            421e56534bf7bd5bc8d9ac5448f8cd0bf6a189e8a3ef4f1d8c493b6196b42b3b

            SHA512

            a436e2c7440b95b013b6cee899a0c131c4f3d54513fd5709cb82314b91887616e8c5682d448a06964d86b88c80a18afcc83a1ada4050d0a9859dd5fab6739b99

            Download Submit

          • memory/2524-11-0x0000000000400000-0x000000000042C000-memory.dmp

            Filesize

            176KB

            Download

          • memory/2524-12-0x0000000000400000-0x000000000042C000-memory.dmp

            Filesize

            176KB

            Download

          • memory/4036-9-0x0000000000400000-0x000000000042C000-memory.dmp

            Filesize

            176KB

            Download