Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2024, 23:23

General

  • Target

    b9ec5d1263ce730e0be1e8cf64c58cf4.exe

  • Size

    1011KB

  • MD5

    b9ec5d1263ce730e0be1e8cf64c58cf4

  • SHA1

    d30aab11a419fc105a15b9505dbeaa931d19c735

  • SHA256

    d481aeca84f16a3284d4de9af3625eb21024f48298538e03b3ec0921f2831046

  • SHA512

    60782d9b3a69403c909e851b353ba93a737a0ea9a17c0b96a472c262a31ef20a37fe5437906396674a8dba0597dac64575d82b03d9361a25714fc4aaff9636b0

  • SSDEEP

    24576:d3BPQLBt4p3UAh2vFjr0AFnOC6R/TJiUr2Fu+8Q:kQktvFjrX+Ldk

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9ec5d1263ce730e0be1e8cf64c58cf4.exe
    "C:\Users\Admin\AppData\Local\Temp\b9ec5d1263ce730e0be1e8cf64c58cf4.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4836
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\06152620\06152620.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:208
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c start C:\PROGRA~3\06152620\06152620.exe /inst
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4564
        • C:\PROGRA~3\06152620\06152620.exe
          C:\PROGRA~3\06152620\06152620.exe /inst
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2504

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~3\06152620\06152620.exe

    Filesize

    1011KB

    MD5

    b9ec5d1263ce730e0be1e8cf64c58cf4

    SHA1

    d30aab11a419fc105a15b9505dbeaa931d19c735

    SHA256

    d481aeca84f16a3284d4de9af3625eb21024f48298538e03b3ec0921f2831046

    SHA512

    60782d9b3a69403c909e851b353ba93a737a0ea9a17c0b96a472c262a31ef20a37fe5437906396674a8dba0597dac64575d82b03d9361a25714fc4aaff9636b0

  • C:\ProgramData\06152620\06152620.bat

    Filesize

    233B

    MD5

    aebeab0f327a309852f8903c8a4314fe

    SHA1

    9f758b15880dd35b564e68e4b1ef976491ba1d66

    SHA256

    f76c4ed4a6b0446184e1ea35a9b12f8fa3337961ea0f9ef2ed1a50edf5a776d9

    SHA512

    d8e650d5ed68fd733569010e99214261a5d3d50f7772df0de443b6871e5d156597443fc75ce11c07a796a2ffcaadaff0eeca32c110852ae26e2775b3e18548d6

  • C:\ProgramData\06152620\06152620.exe

    Filesize

    974KB

    MD5

    f948063dcf2a19e8f243d1045810909a

    SHA1

    3b5c329625490f059e6390a29bd31f4abc0d741f

    SHA256

    3bb4a4bd20aebfa22c4cf85c71f4c6fbc5b1642ed856165dead7d715be8a0a02

    SHA512

    414d83ec7a9251eddd8f6ba965b9e646734a1e57ff6304fcd6612cc6f5ee96b7485c0341b6e49c945df971c4852a4c53b4e476e3bb0811b85ce9955e2f5ff932

  • memory/2504-21-0x0000000000400000-0x00000000005DE000-memory.dmp

    Filesize

    1.9MB

  • memory/2504-23-0x0000000000400000-0x00000000005DE000-memory.dmp

    Filesize

    1.9MB

  • memory/2504-33-0x0000000000400000-0x00000000005DE000-memory.dmp

    Filesize

    1.9MB

  • memory/2504-32-0x0000000000400000-0x00000000005DE000-memory.dmp

    Filesize

    1.9MB

  • memory/2504-31-0x0000000000400000-0x00000000005DE000-memory.dmp

    Filesize

    1.9MB

  • memory/2504-15-0x00000000007A0000-0x00000000008A0000-memory.dmp

    Filesize

    1024KB

  • memory/2504-16-0x0000000000660000-0x0000000000662000-memory.dmp

    Filesize

    8KB

  • memory/2504-17-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

    Filesize

    4KB

  • memory/2504-20-0x0000000000400000-0x00000000005DE000-memory.dmp

    Filesize

    1.9MB

  • memory/2504-30-0x0000000000400000-0x00000000005DE000-memory.dmp

    Filesize

    1.9MB

  • memory/2504-22-0x00000000007A0000-0x00000000008A0000-memory.dmp

    Filesize

    1024KB

  • memory/2504-28-0x0000000000400000-0x00000000005DE000-memory.dmp

    Filesize

    1.9MB

  • memory/2504-24-0x0000000000660000-0x0000000000662000-memory.dmp

    Filesize

    8KB

  • memory/2504-25-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

    Filesize

    4KB

  • memory/2504-26-0x0000000000400000-0x00000000005DE000-memory.dmp

    Filesize

    1.9MB

  • memory/2504-27-0x0000000000400000-0x00000000005DE000-memory.dmp

    Filesize

    1.9MB

  • memory/4836-9-0x0000000000400000-0x00000000005DE000-memory.dmp

    Filesize

    1.9MB

  • memory/4836-1-0x0000000000400000-0x00000000005DE000-memory.dmp

    Filesize

    1.9MB

  • memory/4836-2-0x0000000000660000-0x0000000000760000-memory.dmp

    Filesize

    1024KB

  • memory/4836-3-0x0000000000930000-0x0000000000932000-memory.dmp

    Filesize

    8KB

  • memory/4836-4-0x0000000000990000-0x0000000000991000-memory.dmp

    Filesize

    4KB