f6995555b3cfd7e2e269d96baf245e411a078ea13e38c415939d783f5b80c0a4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 18:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d44086c0018e6fdb2123c6b52ddfc828.exe
Size

161KB
MD5

d44086c0018e6fdb2123c6b52ddfc828
SHA1

99af88a61fd3f7743bc776379d0856eba834042a
SHA256

f6995555b3cfd7e2e269d96baf245e411a078ea13e38c415939d783f5b80c0a4
SHA512

1a13203b22ee44fe843c5b25af43c8ea8a4a44661ce290506da39f82d64dcbd0b817fdad3b597f7968caa34260abbea60bdb1f53c0cbdae45d135e878b562476
SSDEEP

3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/e8J:o68i3odBiTl2+TCU/P

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart"	d44086c0018e6fdb2123c6b52ddfc828.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\winhash_up.exez	d44086c0018e6fdb2123c6b52ddfc828.exe
File opened for modification	C:\Windows\winhash_up.exez	d44086c0018e6fdb2123c6b52ddfc828.exe
File created	C:\Windows\winhash_up.exe	d44086c0018e6fdb2123c6b52ddfc828.exe
File created	C:\Windows\SHARE_TEMP\Icon2.ico	d44086c0018e6fdb2123c6b52ddfc828.exe
File created	C:\Windows\SHARE_TEMP\Icon6.ico	d44086c0018e6fdb2123c6b52ddfc828.exe
File created	C:\Windows\SHARE_TEMP\Icon7.ico	d44086c0018e6fdb2123c6b52ddfc828.exe
File created	C:\Windows\SHARE_TEMP\Icon14.ico	d44086c0018e6fdb2123c6b52ddfc828.exe
File created	C:\Windows\SHARE_TEMP\Icon3.ico	d44086c0018e6fdb2123c6b52ddfc828.exe
File created	C:\Windows\SHARE_TEMP\Icon5.ico	d44086c0018e6fdb2123c6b52ddfc828.exe
File created	C:\Windows\SHARE_TEMP\Icon10.ico	d44086c0018e6fdb2123c6b52ddfc828.exe
File created	C:\Windows\SHARE_TEMP\Icon12.ico	d44086c0018e6fdb2123c6b52ddfc828.exe
File created	C:\Windows\bugMAKER.bat	d44086c0018e6fdb2123c6b52ddfc828.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4260	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4260	4436	d44086c0018e6fdb2123c6b52ddfc828.exe	88
PID 4436 wrote to memory of 4260	4436	d44086c0018e6fdb2123c6b52ddfc828.exe	88
PID 4436 wrote to memory of 4260	4436	d44086c0018e6fdb2123c6b52ddfc828.exe	88

C:\Users\Admin\AppData\Local\Temp\d44086c0018e6fdb2123c6b52ddfc828.exe
"C:\Users\Admin\AppData\Local\Temp\d44086c0018e6fdb2123c6b52ddfc828.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  PID:4260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\bugMAKER.bat

Filesize
76B

MD5
70c28062f4e245c402fd40601da8679b

SHA1
fe15cc0b86d2b4b10cf7d126c100f9e0791cf867

SHA256
26379eff782eb72365873ffe36cbe597bf54cbe52149abb0207119f694f8f8a5

SHA512
a684177c536b6b8ff6cfca4b0bf2a0ca101cb892397a9dbfe7c51c0074775fda49e81dd8e4492b64e6eba0da0cbbf70e365492dfade600623d8a7507985ce7fc

Download Submit
memory/4436-24-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads