Analysis

  • max time kernel
    54s
  • max time network
    58s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/03/2024, 16:30

General

  • Target

  • Size

    14KB

  • MD5

    19dbec50735b5f2a72d4199c4e184960

  • SHA1

    6fed7732f7cb6f59743795b2ab154a3676f4c822

  • SHA256

    a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

  • SHA512

    aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

  • SSDEEP

    192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3372
    • C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]" /main
      2⤵
      • Checks computer location settings
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1568
      • C:\Windows\SysWOW64\notepad.exe
        "C:\Windows\System32\notepad.exe" \note.txt
        3⤵
          PID:1424
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:876
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:4532
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:360
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4968
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:4908
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:4564

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\HHY4LQ3I\recaptcha__en[1].js

            Filesize

            491KB

            MD5

            884d00314602d7cb55bbcd2e909f7310

            SHA1

            dcb353b63aefc091523915f4562a819c31463611

            SHA256

            2c6a3425cec9ba0cbcfcf1dbba2120a72ac369674a6d02e06bd3b0c16efbdcf7

            SHA512

            50091f9e37dcf299bc8cf9cfeed4e71709011713ca0701be0ff79c4fb42699c9f9894cbc3a0819b3fece4f698c2201d403b987e6a76a259fbf58fb19e493b87c

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\P0383SYL\styles__ltr[1].css

            Filesize

            55KB

            MD5

            eb4bc511f79f7a1573b45f5775b3a99b

            SHA1

            d910fb51ad7316aa54f055079374574698e74b35

            SHA256

            7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

            SHA512

            ec9bdf1c91b6262b183fd23f640eac22016d1f42db631380676ed34b962e01badda91f9cbdfa189b42fe3182a992f1b95a7353af41e41b2d6e1dab17e87637a0

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\8N6NWLIA\favicon[1].ico

            Filesize

            5KB

            MD5

            f3418a443e7d841097c714d69ec4bcb8

            SHA1

            49263695f6b0cdd72f45cf1b775e660fdc36c606

            SHA256

            6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

            SHA512

            82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

          • C:\note.txt

            Filesize

            218B

            MD5

            afa6955439b8d516721231029fb9ca1b

            SHA1

            087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

            SHA256

            8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

            SHA512

            5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

          • memory/876-68-0x000001F3ACFE0000-0x000001F3ACFE1000-memory.dmp

            Filesize

            4KB

          • memory/876-2-0x000001F3A6920000-0x000001F3A6930000-memory.dmp

            Filesize

            64KB

          • memory/876-18-0x000001F3A6D00000-0x000001F3A6D10000-memory.dmp

            Filesize

            64KB

          • memory/876-37-0x000001F3A6FE0000-0x000001F3A6FE2000-memory.dmp

            Filesize

            8KB

          • memory/876-69-0x000001F3ACFF0000-0x000001F3ACFF1000-memory.dmp

            Filesize

            4KB

          • memory/4908-158-0x0000013680380000-0x0000013680480000-memory.dmp

            Filesize

            1024KB

          • memory/4908-277-0x0000013EEDC50000-0x0000013EEDC60000-memory.dmp

            Filesize

            64KB

          • memory/4908-64-0x0000013EFEBD0000-0x0000013EFEBD2000-memory.dmp

            Filesize

            8KB

          • memory/4908-62-0x0000013EEE1F0000-0x0000013EEE1F2000-memory.dmp

            Filesize

            8KB

          • memory/4908-99-0x0000013EFF620000-0x0000013EFF720000-memory.dmp

            Filesize

            1024KB

          • memory/4908-108-0x0000013EFF620000-0x0000013EFF720000-memory.dmp

            Filesize

            1024KB

          • memory/4908-60-0x0000013EEE1D0000-0x0000013EEE1D2000-memory.dmp

            Filesize

            8KB

          • memory/4908-58-0x0000013EEE1B0000-0x0000013EEE1B2000-memory.dmp

            Filesize

            8KB

          • memory/4908-184-0x0000013691290000-0x0000013691292000-memory.dmp

            Filesize

            8KB

          • memory/4908-189-0x00000136912B0000-0x00000136912B2000-memory.dmp

            Filesize

            8KB

          • memory/4908-216-0x0000013691BD0000-0x0000013691BD2000-memory.dmp

            Filesize

            8KB

          • memory/4908-275-0x0000013EEDC50000-0x0000013EEDC60000-memory.dmp

            Filesize

            64KB

          • memory/4908-276-0x0000013EEDC50000-0x0000013EEDC60000-memory.dmp

            Filesize

            64KB

          • memory/4908-66-0x0000013EFED10000-0x0000013EFED12000-memory.dmp

            Filesize

            8KB

          • memory/4908-278-0x0000013EEDC50000-0x0000013EEDC60000-memory.dmp

            Filesize

            64KB

          • memory/4908-279-0x0000013EEDC50000-0x0000013EEDC60000-memory.dmp

            Filesize

            64KB

          • memory/4908-280-0x0000013EEDC50000-0x0000013EEDC60000-memory.dmp

            Filesize

            64KB

          • memory/4908-281-0x0000013EEDC50000-0x0000013EEDC60000-memory.dmp

            Filesize

            64KB

          • memory/4908-282-0x0000013EEDC50000-0x0000013EEDC60000-memory.dmp

            Filesize

            64KB

          • memory/4908-285-0x0000013EEDC50000-0x0000013EEDC60000-memory.dmp

            Filesize

            64KB

          • memory/4908-284-0x0000013EEDC50000-0x0000013EEDC60000-memory.dmp

            Filesize

            64KB

          • memory/4908-283-0x0000013EEDC50000-0x0000013EEDC60000-memory.dmp

            Filesize

            64KB

          • memory/4908-286-0x0000013EEDC50000-0x0000013EEDC60000-memory.dmp

            Filesize

            64KB

          • memory/4908-287-0x0000013EEDC50000-0x0000013EEDC60000-memory.dmp

            Filesize

            64KB

          • memory/4908-56-0x0000013EEE190000-0x0000013EEE192000-memory.dmp

            Filesize

            8KB