529365d7e6520ef2d812fc361a135d910d639a6468d0203fcddf6e0819661832

Analysis

max time kernel
81s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7f6cbbe68d2d92b0721408708c37dd5.exe
Size

126KB
MD5

b7f6cbbe68d2d92b0721408708c37dd5
SHA1

9ce99e33a1a4e161bb2b6fb99003f79d9778fc59
SHA256

529365d7e6520ef2d812fc361a135d910d639a6468d0203fcddf6e0819661832
SHA512

a9aec2fe83a9ef871cc3b94ce53c9ec52e1df736847cb4a0f0ecdea36a2d28a637ceb124a812f081ffeac8607e9263312ae203cd2f5a36101f819a93f673f360
SSDEEP

3072:dDKERFTYi2rQULKl6hp1fD4JQONLKcvM3/BLBvout2s:FKERFTYi2s6Kl+DbOdDvM35LxoS2

Score

7^/10

persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	b7f6cbbe68d2d92b0721408708c37dd5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Protect.exe

Executes dropped EXE 4 IoCs

pid	Process
4628	Protect.exe
4652	Protect.exe
1072	000000000.exe
2964	000000000.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/684-0-0x0000000000400000-0x0000000000542000-memory.dmp	upx
behavioral2/files/0x0007000000023227-11.dat	upx
behavioral2/memory/684-18-0x0000000000400000-0x0000000000542000-memory.dmp	upx
behavioral2/memory/4628-19-0x0000000000400000-0x0000000000542000-memory.dmp	upx
behavioral2/memory/4652-22-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4652-26-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4652-28-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/4628-29-0x0000000000400000-0x0000000000542000-memory.dmp	upx
behavioral2/memory/4652-33-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/1072-97-0x0000000000400000-0x0000000000542000-memory.dmp	upx
behavioral2/memory/1072-105-0x0000000000400000-0x0000000000542000-memory.dmp	upx
behavioral2/memory/4652-106-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/2964-108-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\run32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Adobee\\Protect.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ProtSys = "C:\\Users\\Admin\\AppData\\Roaming\\156372586.exe"	Protect.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ProtSys = "C:\\Users\\Admin\\AppData\\Roaming\\Adobee\\Protect.exe"	Protect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ProtSys = "C:\\Users\\Admin\\AppData\\Roaming\\Adobee\\Protect.exe"	Protect.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4628 set thread context of 4652	4628	Protect.exe	95
PID 1072 set thread context of 2964	1072	000000000.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Protect.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4652	Protect.exe
4652	Protect.exe
4652	Protect.exe
4652	Protect.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4652	Protect.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
684	b7f6cbbe68d2d92b0721408708c37dd5.exe
4628	Protect.exe
1072	000000000.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 3964	684	b7f6cbbe68d2d92b0721408708c37dd5.exe	90
PID 684 wrote to memory of 3964	684	b7f6cbbe68d2d92b0721408708c37dd5.exe	90
PID 684 wrote to memory of 3964	684	b7f6cbbe68d2d92b0721408708c37dd5.exe	90
PID 3964 wrote to memory of 212	3964	cmd.exe	93
PID 3964 wrote to memory of 212	3964	cmd.exe	93
PID 3964 wrote to memory of 212	3964	cmd.exe	93
PID 684 wrote to memory of 4628	684	b7f6cbbe68d2d92b0721408708c37dd5.exe	94
PID 684 wrote to memory of 4628	684	b7f6cbbe68d2d92b0721408708c37dd5.exe	94
PID 684 wrote to memory of 4628	684	b7f6cbbe68d2d92b0721408708c37dd5.exe	94
PID 4628 wrote to memory of 4652	4628	Protect.exe	95
PID 4628 wrote to memory of 4652	4628	Protect.exe	95
PID 4628 wrote to memory of 4652	4628	Protect.exe	95
PID 4628 wrote to memory of 4652	4628	Protect.exe	95
PID 4628 wrote to memory of 4652	4628	Protect.exe	95
PID 4628 wrote to memory of 4652	4628	Protect.exe	95
PID 4628 wrote to memory of 4652	4628	Protect.exe	95
PID 4628 wrote to memory of 4652	4628	Protect.exe	95
PID 4652 wrote to memory of 1072	4652	Protect.exe	96
PID 4652 wrote to memory of 1072	4652	Protect.exe	96
PID 4652 wrote to memory of 1072	4652	Protect.exe	96
PID 1072 wrote to memory of 2964	1072	000000000.exe	97
PID 1072 wrote to memory of 2964	1072	000000000.exe	97
PID 1072 wrote to memory of 2964	1072	000000000.exe	97
PID 1072 wrote to memory of 2964	1072	000000000.exe	97
PID 1072 wrote to memory of 2964	1072	000000000.exe	97
PID 1072 wrote to memory of 2964	1072	000000000.exe	97
PID 1072 wrote to memory of 2964	1072	000000000.exe	97
PID 1072 wrote to memory of 2964	1072	000000000.exe	97

C:\Users\Admin\AppData\Local\Temp\b7f6cbbe68d2d92b0721408708c37dd5.exe
"C:\Users\Admin\AppData\Local\Temp\b7f6cbbe68d2d92b0721408708c37dd5.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\redsu.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "run32.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Adobee\Protect.exe" /f
    3⤵
    - Adds Run key to start application
    PID:212
- C:\Users\Admin\AppData\Roaming\Adobee\Protect.exe
  "C:\Users\Admin\AppData\Roaming\Adobee\Protect.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Users\Admin\AppData\Roaming\Adobee\Protect.exe
    C:\Users\Admin\AppData\Roaming\Adobee\Protect.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Users\Admin\AppData\Roaming\000000000.exe
      "C:\Users\Admin\AppData\Roaming\000000000.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1072
    - - C:\Users\Admin\AppData\Roaming\000000000.exe
        
        C:\Users\Admin\AppData\Roaming\000000000.exe
        5⤵
        Executes dropped EXE
        
        PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\redsu.bat

Filesize
143B

MD5
a18a2abad17b668162699428d77107b8

SHA1
153bafd32584d527e7be1233203adc6bff2658a0

SHA256
d0c4c5b6a90a9c986028d946c11321b250773da41e64a63f16fa94652e3f3b5f

SHA512
f8f26a185b0735c0f0859a8eb03d35a0313062efb080d83569b7620a445be2318c0e594a539719bf88a3ec3417f0d1954137620c2fd83bf9214b89fca8126556

Download Submit
C:\Users\Admin\AppData\Roaming\Adobee\Protect.exe

Filesize
126KB

MD5
b7f6cbbe68d2d92b0721408708c37dd5

SHA1
9ce99e33a1a4e161bb2b6fb99003f79d9778fc59

SHA256
529365d7e6520ef2d812fc361a135d910d639a6468d0203fcddf6e0819661832

SHA512
a9aec2fe83a9ef871cc3b94ce53c9ec52e1df736847cb4a0f0ecdea36a2d28a637ceb124a812f081ffeac8607e9263312ae203cd2f5a36101f819a93f673f360

Download Submit
memory/684-18-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/684-0-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/1072-97-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/1072-105-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/2964-108-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4628-19-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/4628-29-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/4652-26-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4652-33-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4652-32-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/4652-28-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4652-106-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4652-22-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download