Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/02/2024, 06:12

General

  • Target

    addfc1ec8a277f7692892fff20e5490e.exe

  • Size

    133KB

  • MD5

    addfc1ec8a277f7692892fff20e5490e

  • SHA1

    583c8d6eced0c465c2dd2a9afb47739a4d163c03

  • SHA256

    ad2983c9d385ee2e332d76e417818e7c86a74c753255541631290e917e1e4db6

  • SHA512

    1c93eeb62b428bf5c4aac5a91de7819565775a107d82e07be84dbefda8a4643b9aedbebb76f13e133d1fb23d29326ca86671f6dcbbd8dd04add5eb895f7f762a

  • SSDEEP

    3072:fRMqjl4A6wDzmRIFulk6BLMuqT995Zoole5TJj4:pMCGA60zVW2uqTXlevj

Score
8/10

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\addfc1ec8a277f7692892fff20e5490e.exe
    "C:\Users\Admin\AppData\Local\Temp\addfc1ec8a277f7692892fff20e5490e.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Windows\SysWOW64\inf\svchostc.exe
      "C:\Windows\system32\inf\svchostc.exe" C:\Windows\twftadfia16_080615.dll tanlt88
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2948
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c "c:\mylstecj.bat"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3540
        • C:\Windows\system\sgcxcxxaspf080615.exe
          "C:\Windows\system\sgcxcxxaspf080615.exe" i
          4⤵
          • Adds policy Run key to start application
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Windows directory
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3924
          • C:\Program Files\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1008
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1008 CREDAT:17410 /prefetch:2
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2200

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K4KS10IH\suggestions[1].en-US

          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

        • C:\Windows\SysWOW64\inf\svchostc.exe

          Filesize

          60KB

          MD5

          889b99c52a60dd49227c5e485a016679

          SHA1

          8fa889e456aa646a4d0a4349977430ce5fa5e2d7

          SHA256

          6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

          SHA512

          08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

        • C:\Windows\system\sgcxcxxaspf080615.exe

          Filesize

          133KB

          MD5

          addfc1ec8a277f7692892fff20e5490e

          SHA1

          583c8d6eced0c465c2dd2a9afb47739a4d163c03

          SHA256

          ad2983c9d385ee2e332d76e417818e7c86a74c753255541631290e917e1e4db6

          SHA512

          1c93eeb62b428bf5c4aac5a91de7819565775a107d82e07be84dbefda8a4643b9aedbebb76f13e133d1fb23d29326ca86671f6dcbbd8dd04add5eb895f7f762a

        • C:\Windows\tdcbdcasys32_080615.dll

          Filesize

          219KB

          MD5

          9ffcad679063d56de00784483f203367

          SHA1

          ae617a526451e6e286ba393d49bde048f43ec4c6

          SHA256

          ecc842b207eb390c9b17215975f409719ca323064783c8646f1e15a01ea7e939

          SHA512

          7ba6f805fbbbbd78fe2ddf3c47ea0b284a9d5046690c1ebdb498b594c5345b77b0fce84c1e3848ed707299f7a7a788fb21bd6702ea3461e9db9f54d7bb767b7f

        • C:\Windows\twftadfia16_080615.dll

          Filesize

          31KB

          MD5

          4b0a833136e7db417c3553674fae561e

          SHA1

          8cec9a200575227bbc45566b7f16d688e2dcedda

          SHA256

          7502fe8ead3a2d449643981fc9aa06370675ea4c3348161f1926c6bdf0a563cc

          SHA512

          b945ce854f58857d6d7f2624a6f98aa5fa3e6188e9f3baafa91ee920fb0818e486a9e521179f15500370a8b18ea07ab7ad33683165af154d3a962090cf16dcb6

        • C:\Windows\twisys.ini

          Filesize

          46B

          MD5

          033bcec777267cf4358ac0da4cac6dc9

          SHA1

          b8127384122b57e301988bf059fac49d86f83c14

          SHA256

          78313879e727cfc88bbc95ae05af2893e7699a29c14fb3ca421c72c3b0b357a7

          SHA512

          12fb21c483a752606fd51ce44fbdf1ca2cbfe9694ffc466ab89fcc7f71fcfe6832ab958148d12f7fe66cd043893b32d72544628ba577704a7fbd916fe0f3c768

        • C:\Windows\twisys.ini

          Filesize

          434B

          MD5

          0fb7f4692482afc5f6f3ccbf08f62948

          SHA1

          a534f4dee03ce489c32bb2515d2324a03c0ef24a

          SHA256

          6190340f935e87c36666da60370fdddac8ecefc482494ccd5aa56803a51a20d0

          SHA512

          f6f090fc7a1848bd4ca4553ef3751b478b4f95d171bd48d55e6668c1381f37e4fe4cee88e26141a9687a3a086aa21d558a658330a1438ac4aef14bc3393c18b0

        • C:\Windows\twisys.ini

          Filesize

          364B

          MD5

          cc72aef041857e3e9ff2f15086e2ae99

          SHA1

          3afb52c396174e2604c78c8c807a246c8619f1e4

          SHA256

          418c868147c2f2aa1c9b988ef8f489ab312229be4bc346ce88e0823fbfb9f101

          SHA512

          4dbe7201d2021dd0e08d8f3d6bb56a94cd1e213606eb8f629ba7ea73c74928c2f1bcf77107bf732ded22067663cce3d0d2089ebd5e6048472643aa22d8b05b37

        • C:\Windows\twisys.ini

          Filesize

          392B

          MD5

          87c70147b275110dff5c42d2db300398

          SHA1

          25a35b0297783b2f3b46998072d1e3deeb9f8aa0

          SHA256

          f98de0d242dfb3a3c393be55c74c7f1c0e4f7f5fd9da16e5ad56079b596f99dc

          SHA512

          1d77f90a865bec01b56e9afeccfc006b4896d1963a6468a6b6285f180870da0acb9594eb6822f4fb533bd107a2d59eb03325adee047a86778e3ccf0d2e459ddc

        • C:\Windows\twisys.ini

          Filesize

          398B

          MD5

          e9f1507c7900c1ae4af3a2186f145c9f

          SHA1

          00ffa170d8972a2fa2d756308b73b9ccbac5adb2

          SHA256

          de39ea4dd4d0502427dfb422cf63ffb06eaa984cb87605210c5b9ea221169246

          SHA512

          ac7755bfb33375b1f85bb1687f26d61ab0b2b8ed0981c3ddfddef59a421cd5904e054e5fd5d321bc7b370661bc56a07efd9391b42925dd172c857c37bbacf186

        • C:\Windows\twisys.ini

          Filesize

          431B

          MD5

          cf5a25fcbd841f46d05bf61739112940

          SHA1

          4a6cee80fc764aa0ddb582dc769769600c1103a2

          SHA256

          38831f11afb10e5f9f4deca22b71857eaa957560754513efc56037cc2e4f5557

          SHA512

          3ec2655904c162c2004f62aa5124140460aac999d21b4fae448b8a3fe59cc3d562e70603484508659408137a99302e993e6dae5e3319459d2a738cf24ebad72d

        • C:\Windows\twisys.ini

          Filesize

          458B

          MD5

          c6a0598d2f107431eff2e13f692a9dff

          SHA1

          2a238988a95f6d2af9e578694e7f6e9ff483f2e8

          SHA256

          b86a02746049603c2e2f4931fc184dc906ba30039e4dfcd62f88854156a87bd4

          SHA512

          4a4f02c1047f83b1f54b128bde5ef00b3e53f6c277a094f75a3dcb94ca8f6b452efd0213179e937d3855de1bcbe108433407a54322fa279f1c67d415b02f0c60

        • \??\c:\mylstecj.bat

          Filesize

          53B

          MD5

          da1246d60fb14fd94892aed08d4efdea

          SHA1

          9cbb3efeb757112bea4538923727eb6aac9d852e

          SHA256

          676b0f775d503b049bddbdc12898718483b6a4dfc692fc4c3d9fc07fdd0be234

          SHA512

          0d6ecbc5ed71133ba1ea3b83fdcd29162d6972edc3524bcc47c233c394f24c6b1c09a7b3cbb00cda10ce9497610ecfcb5b8714f0eb8a7750e953b084e623cdc9

        • memory/1748-52-0x0000000000400000-0x0000000000452000-memory.dmp

          Filesize

          328KB

        • memory/2948-65-0x0000000000400000-0x000000000040E000-memory.dmp

          Filesize

          56KB

        • memory/2948-74-0x0000000000400000-0x000000000040E000-memory.dmp

          Filesize

          56KB

        • memory/2948-89-0x0000000000400000-0x000000000040E000-memory.dmp

          Filesize

          56KB

        • memory/2948-109-0x0000000000400000-0x000000000040E000-memory.dmp

          Filesize

          56KB

        • memory/3924-73-0x0000000000400000-0x0000000000452000-memory.dmp

          Filesize

          328KB

        • memory/3924-82-0x0000000000400000-0x0000000000452000-memory.dmp

          Filesize

          328KB

        • memory/3924-88-0x0000000000400000-0x0000000000452000-memory.dmp

          Filesize

          328KB