Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
10/03/2024, 20:47
Behavioral task
behavioral1
Sample
4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3.exe
- Size 368KB
- Sample240310-zkzqcsbf64
- SHA256 4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3
- MD5 23004245ae5f9a67e5a05834ac4a86d8
- SHA1 9426e404d952d8d9992c28b5bd7cb48171d8c5aa
- SHA512 eb58bb1b1bbfa638b5593566484fdcfa6272dc26336ee4a690af58353348320629c73007d34e41cc69e2705b1760c6147fba4d8359f2c207754fc44c13bc3a07
- SSDEEP 6144:CcKp6l030ly3Li2pmzGqGsl5lvyRn3uXdu0ua8RiVpJm:CrAM0ly3O2A9GApq3uJ0i4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation novir.exe - Executes dropped EXE 2 IoCs
pid Process 4480 novir.exe 3284 afdap.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe 3284 afdap.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 220 wrote to memory of 4480 220 4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3.exe 94 PID 220 wrote to memory of 4480 220 4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3.exe 94 PID 220 wrote to memory of 4480 220 4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3.exe 94 PID 220 wrote to memory of 1668 220 4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3.exe 95 PID 220 wrote to memory of 1668 220 4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3.exe 95 PID 220 wrote to memory of 1668 220 4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3.exe 95 PID 4480 wrote to memory of 3284 4480 novir.exe 107 PID 4480 wrote to memory of 3284 4480 novir.exe 107 PID 4480 wrote to memory of 3284 4480 novir.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3.exe"C:\Users\Admin\AppData\Local\Temp\4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\novir.exe"C:\Users\Admin\AppData\Local\Temp\novir.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\afdap.exe"C:\Users\Admin\AppData\Local\Temp\afdap.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3284
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵PID:1668
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
- Size 340B
- SHA256 c8fad78910257978a5f7450fcefc29730f777d2d2c542c6ac6d0a83f7d99689f
- MD5 863c2ef845a944251c0a5536f374e58a
- SHA1 78c230e393b2e678f8a57889391fdc039479f790
- SHA512 012d64618bca3ad094692f7acec7513101bfb1fb0b706ceb3f65df5899fae70d98f32e2769c6b8e05f05b41b3385b06a392234f6db87e9eda3b86f85f6934e02
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\afdap.exe
- Size 193KB
- SHA256 a40a4541d86ab239041356d9d138f6fcc759adabb821966d7fe17bc476492f3c
- MD5 30b2c3fda0eaf1278e8dfb39022c505e
- SHA1 4373c468e912f1fe40ca131450d3b73d47e91c96
- SHA512 8b12df4d76c7d69021a8d325a7043edc31b13a3c21b4ffdde3e71e5f7b961a058e1486646374be065b4d05c84abcc1ddafd511bee39664cc6eb4e48f8e3ac800
- SSDEEP 6144:j6nP624P2po3l2bTCE5RQ6dHm7h7yaeCngjwj:k6nuMOC56d8hGpCngkj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
- Size 512B
- SHA256 75dc9a9875ef000b5a738e3ea7659576f021a1eb73bdc2f85646f5fecf90d31c
- MD5 3c2765b1a6a7d40208dc53d6fcd922e1
- SHA1 24d1862c0ff2f7c7782e5ba6f46efa47866ccf6e
- SHA512 0f0144d6f843c97a08c16153ebaa8d8666631e87fe529ca55e2b140011bc88d14162e6fefe532acf3eb459d65c0de4a249c768c334d14576671aed5ce0970e72
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\novir.exe
- Size 368KB
- SHA256 c044fbcc7cc393c1300d47654e3952e75b6ce9926ad9db3e03481ac2f4986e5d
- MD5 26f3e1a1b5a1ac5d1a9c6cbfab7f3c62
- SHA1 bb071f352bcd858e50bb53f5d779321d214ebc04
- SHA512 7853e947ac609d0b184f4f051702f2d6e8e329603acd6d46edfbf5d39215367afa20ffdb984017a33578623ae848f1a1a6fc93794278f87418154816a754e194
- SSDEEP 6144:CcKp6l030ly3Li2pmzGqGsl5lvyRn3uXdu0ua8RiVpJ+:CrAM0ly3O2A9GApq3uJ0iU
- MD5 SHA1 SHA512 SSDEEP