Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2024, 17:37

General

  • Target

    027224e42ddba610a50c3bd948d8c81d824de1adc8d031808c6a65d3c291ac20.exe

  • Size

    199KB

  • MD5

    310020d11dca5daa292c6d121ce044e0

  • SHA1

    974b85852d942d4bcf7fba23fc417d9083c1fb7d

  • SHA256

    027224e42ddba610a50c3bd948d8c81d824de1adc8d031808c6a65d3c291ac20

  • SHA512

    39e7f13bb2a2e17f3a7e057a11567e1f70494181a08fe7d0847917677b8a4320c74105666b007bd25f697a739dc244fa12d2aac10e4ad0ce99597d01e3c729e7

  • SSDEEP

    6144:FsaocyLCxJy0823optx30uY4OifzyHFuNn:FtobQy089tx3DYfGzyluNn

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\027224e42ddba610a50c3bd948d8c81d824de1adc8d031808c6a65d3c291ac20.exe
    "C:\Users\Admin\AppData\Local\Temp\027224e42ddba610a50c3bd948d8c81d824de1adc8d031808c6a65d3c291ac20.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4184
    • C:\Users\Admin\AppData\Local\Temp\nsd2973.tmp\inst.exe
      C:\Users\Admin\AppData\Local\Temp\nsd2973.tmp\inst.exe 4e9422ac-75a8-4a0f-9b5b-46785bc06f2f.exe /dT131491501S /e4813309 /t /u4e9422ac-75a8-4a0f-9b5b-46785bc06f2f
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:4144
      • C:\Users\Admin\AppData\Local\Temp\nsd2973.tmp\4e9422ac-75a8-4a0f-9b5b-46785bc06f2f.exe
        "C:\Users\Admin\AppData\Local\Temp\nsd2973.tmp\4e9422ac-75a8-4a0f-9b5b-46785bc06f2f.exe" /dT131491501S /e4813309 /t /u4e9422ac-75a8-4a0f-9b5b-46785bc06f2f
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2244

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F39B5CFACECFDE48DB25BCA2231FAC6_F0E2901B5CB9DFCB03318B8D06C40A30

    Filesize

    1KB

    MD5

    3f4f56ba8e6d4467067ab67d38382af2

    SHA1

    507bdd129d7e01a8b3f6da087454d4638283b7e9

    SHA256

    24bcfb5601bfc7f9140013257df5767a2974e0f3182f7df060c026d3be21cc0f

    SHA512

    3e2a37b61cbc1d7d28d8c6ef772098b523af071e870348e7e233d01ceee52de72ece9445cb622805b283dc19cacfe83ac6f8508711432e3dd473fed5d3b744f2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EDCF682921FE94F4A02A43CD1A28E6B

    Filesize

    604B

    MD5

    a8c8eb8bf71ea727e35148b09b26fec7

    SHA1

    f4ab4a15766b9d1e7253ecbb20973af8affbdb7c

    SHA256

    21c9949032173647ca9cd7fd03822577e2eaeefa0954974f9dd8a9d7ed4c0e13

    SHA512

    dc04414bf8dd78dafef8d5582ced4c8ab9e466354c03ddaa3014c1400934692a4dbabbf6200616e5364b4a69ce4192f283852a126c1e938a1705cd005d0c6d55

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\955CAB6FF6A24D5820D50B5BA1CF79C7_CC1689C2A9A5CB35265F3C2516751959

    Filesize

    5B

    MD5

    4842e206e4cfff2954901467ad54169e

    SHA1

    80c9820ff2efe8aa3d361df7011ae6eee35ec4f0

    SHA256

    2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e

    SHA512

    ff537b1808fcb03cfb52f768fbd7e7bd66baf6a8558ee5b8f2a02f629e021aa88a1df7a8750bae1f04f3b9d86da56f0bdcba2fdbc81d366da6c97eb76ecb6cba

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F39B5CFACECFDE48DB25BCA2231FAC6_F0E2901B5CB9DFCB03318B8D06C40A30

    Filesize

    412B

    MD5

    f3753048ffe0e04070a6f1d764cf3551

    SHA1

    f325ce21e0c376e82d0dc8e297e258e5ba86f256

    SHA256

    7e4a4051b32edc4b1d18e8a63e31fee53a36c81bba00cf3f81eae3e291b48fe5

    SHA512

    229346a06e51af258aec80b5823a19eb92f3103d25096ec6a0331dcac91a503f6bb40d9e309589978453b4935791bb06095706ea3f19014bfe7899694f0db4a4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EDCF682921FE94F4A02A43CD1A28E6B

    Filesize

    188B

    MD5

    9237a3311870d0f2fc8cf6d7b5848071

    SHA1

    a47af01bcecc76e97d19d98f9a254ad88c25b8bf

    SHA256

    751441b624efa3c5b931709dd9e48597f398dc16ae203cb017d081f42316327e

    SHA512

    b85f86d8a2c44fcc3b0237b45c30f790ce057c0098d53d80e0d769560a6314e7b4a01afa8a7d40e4a545412037ad1145200d353d07fec94bde8ec82398a2ad50

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9

    Filesize

    404B

    MD5

    7099eb53879f2f70b32004ff5456923d

    SHA1

    78a7ce81f3da74cb7cc0db35e6e3bda45c1d313f

    SHA256

    0cb3549f7c6128652c3ee82ca578c432fcdcf61466ba749dc1e80b247382f500

    SHA512

    966ec059c611bc88f67aa4f18b30af8ab29acad40c200eba89ccc5060185221fd35dd9c1ba60d1939fc27a63e126ff7b6c1a7c16d67347a30e47119a7bdf8b78

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\955CAB6FF6A24D5820D50B5BA1CF79C7_CC1689C2A9A5CB35265F3C2516751959

    Filesize

    482B

    MD5

    af034f010120de24e324c6fe158f6aa8

    SHA1

    fb11f24748f09797f91c51fd3a4ba241b248019b

    SHA256

    cc6be2e18cda50e4f6414509da379456c5a84e9b8dfd0c1f6cd6c6b3f95acbbb

    SHA512

    68370fc5efe11aa3d2f24be370de2b2dc444c13d81e789afbe9a539b0ac7f49ddc4d553fd27b7b9606f372c5e55d95e0f44e73203fbbdc5916a7287d9d4a4a13

  • C:\Users\Admin\AppData\Local\Temp\nsd2973.tmp\4e9422ac-75a8-4a0f-9b5b-46785bc06f2f.exe

    Filesize

    163KB

    MD5

    c79eb4f84596b7e43f7800b158c034c4

    SHA1

    23c3184f55dc9dce991662f5fd38d95054930f56

    SHA256

    a153b4705136b923cfc8fcf3fc7cee6539039f410abc99719ff5edb8ef3c23ec

    SHA512

    5f5eeeb35ecfc95fdf306c2e984ffc0c610c295b3e35fdd9f87d6f03362210e66155910aa16c31ef35162a39a536ee9e0c57463f3d5081e2185e905e9cd759a9

  • C:\Users\Admin\AppData\Local\Temp\nsd2973.tmp\inst.exe

    Filesize

    143KB

    MD5

    0f9c02df96da8a059c83ddfcfc0f8c6a

    SHA1

    2a3fa9056603c843a4c086136557c4ad9cd190c3

    SHA256

    56099fbbb997f4fdee7bcb8fabe62f3d49273028bcee7f12018e6c18b54af455

    SHA512

    1481ca881e19074da73a46009d35d12e4221ec6f8c9aefe007a0a9d12d52eef4db6c5a38dfda18922d0fffd519c15032997df1df7c79f93361650f91476bbe7b

  • C:\Users\Admin\AppData\Local\Temp\nsd2973.tmp\nsExec.dll

    Filesize

    8KB

    MD5

    249ae678f0dac4c625c6de6aca53823a

    SHA1

    6ac2b9e90e8445fed4c45c5dbf2d0227cd3b5201

    SHA256

    7298024a36310b7c4c112be87b61b62a0b1be493e2d5252a19e5e976daf674ce

    SHA512

    66e4081a40f3191bf28b810cf8411cb3c8c3e3ec5943e18d6672414fb5e7b4364f862cba44c9115c599ac90890ef02a773e254e7c979e930946bc52b0693aad7

  • memory/2244-62-0x0000000074920000-0x0000000074ED1000-memory.dmp

    Filesize

    5.7MB

  • memory/2244-43-0x0000000074920000-0x0000000074ED1000-memory.dmp

    Filesize

    5.7MB

  • memory/2244-60-0x0000000000B10000-0x0000000000B20000-memory.dmp

    Filesize

    64KB

  • memory/2244-52-0x0000000074920000-0x0000000074ED1000-memory.dmp

    Filesize

    5.7MB

  • memory/2244-59-0x0000000000B10000-0x0000000000B20000-memory.dmp

    Filesize

    64KB

  • memory/2244-58-0x0000000000B10000-0x0000000000B20000-memory.dmp

    Filesize

    64KB

  • memory/2244-53-0x0000000000B10000-0x0000000000B20000-memory.dmp

    Filesize

    64KB

  • memory/4144-26-0x000000001C0E0000-0x000000001C100000-memory.dmp

    Filesize

    128KB

  • memory/4144-9-0x00007FF99C700000-0x00007FF99D0A1000-memory.dmp

    Filesize

    9.6MB

  • memory/4144-10-0x00007FF99C700000-0x00007FF99D0A1000-memory.dmp

    Filesize

    9.6MB

  • memory/4144-11-0x0000000000FE0000-0x0000000000FF0000-memory.dmp

    Filesize

    64KB

  • memory/4144-30-0x0000000000FE0000-0x0000000000FF0000-memory.dmp

    Filesize

    64KB

  • memory/4144-42-0x00007FF99C700000-0x00007FF99D0A1000-memory.dmp

    Filesize

    9.6MB

  • memory/4184-57-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB