339819179b6db5f8b40b6127d88b9075d53905f571168bf739aa24495dd13d23

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b41772e3173186f8cb53f8ae67096e1e.exe
Size

197KB
MD5

b41772e3173186f8cb53f8ae67096e1e
SHA1

bca44155b1d44ceeb54b91317a99b8c0f4e1635a
SHA256

339819179b6db5f8b40b6127d88b9075d53905f571168bf739aa24495dd13d23
SHA512

ee25b7e058d544b62e6039fcaa5dd9eda8a285b91a689565701258d063e9426790a4e84cf6c97864ec83b3a62b28b49824a5874b91d43795ad7b384380fad0da
SSDEEP

3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/e8LtkaZgxki1:o68i3odBiTl2+TCU/9tkqi1

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart"	b41772e3173186f8cb53f8ae67096e1e.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\winhash_up.exe	b41772e3173186f8cb53f8ae67096e1e.exe
File created	C:\Windows\SHARE_TEMP\Icon2.ico	b41772e3173186f8cb53f8ae67096e1e.exe
File created	C:\Windows\SHARE_TEMP\Icon5.ico	b41772e3173186f8cb53f8ae67096e1e.exe
File created	C:\Windows\SHARE_TEMP\Icon14.ico	b41772e3173186f8cb53f8ae67096e1e.exe
File created	C:\Windows\bugMAKER.bat	b41772e3173186f8cb53f8ae67096e1e.exe
File created	C:\Windows\SHARE_TEMP\Icon10.ico	b41772e3173186f8cb53f8ae67096e1e.exe
File created	C:\Windows\SHARE_TEMP\Icon12.ico	b41772e3173186f8cb53f8ae67096e1e.exe
File created	C:\Windows\winhash_up.exez	b41772e3173186f8cb53f8ae67096e1e.exe
File opened for modification	C:\Windows\winhash_up.exez	b41772e3173186f8cb53f8ae67096e1e.exe
File created	C:\Windows\SHARE_TEMP\Icon3.ico	b41772e3173186f8cb53f8ae67096e1e.exe
File created	C:\Windows\SHARE_TEMP\Icon6.ico	b41772e3173186f8cb53f8ae67096e1e.exe
File created	C:\Windows\SHARE_TEMP\Icon7.ico	b41772e3173186f8cb53f8ae67096e1e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1824	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1824	1208	b41772e3173186f8cb53f8ae67096e1e.exe	87
PID 1208 wrote to memory of 1824	1208	b41772e3173186f8cb53f8ae67096e1e.exe	87
PID 1208 wrote to memory of 1824	1208	b41772e3173186f8cb53f8ae67096e1e.exe	87

C:\Users\Admin\AppData\Local\Temp\b41772e3173186f8cb53f8ae67096e1e.exe
"C:\Users\Admin\AppData\Local\Temp\b41772e3173186f8cb53f8ae67096e1e.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\bugMAKER.bat

Filesize
76B

MD5
4eeaeef7d18d8621a5c0edd7cac5012f

SHA1
a5e532884e63bb6075e7c30a76d878e468462b57

SHA256
0866f19bd5cafe3058cd55b756bab73c03c96ed6eadd5370b8e0de6f7e807138

SHA512
345272323c719e5e6b91a96de21dec4e6a02919baeefa830d0653665a126d37ee2cec6cb947b3419d911d79bc4ade93f0fbd26a1a0cc552f0ee93b5b48b9b6eb

Download Submit
memory/1208-24-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads