Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
25/03/2024, 12:14
General
-
Target
ddfbe52e121a54390cd2a4966b3c991b.exe
-
Size
454KB
-
MD5
ddfbe52e121a54390cd2a4966b3c991b
-
SHA1
e89bb7fdb552627ee6b2cd570351a05e90233f08
-
SHA256
863556ff60232cc0ba03d64e840b802ea35bd8afd0031fce289965445e072917
-
SHA512
c24548ef34d1dc27d3115220fb63640e44d17fb982f2c0f324e98f76fef0a878d9cd653f935e9f8cdf080f399bfddd431a92da1110126a9a506b3d062fd73478
-
SSDEEP
12288:Rp//VS1fyNomS6olwkJeBMMMnMMMMM/HwE6C7rRWkiUk:7/McNvh+MMnMMMMM/HL6C
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddfbe52e121a54390cd2a4966b3c991b.exe"C:\Users\Admin\AppData\Local\Temp\ddfbe52e121a54390cd2a4966b3c991b.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\HhFEKGHKxwvKC.exe"C:\ProgramData\HhFEKGHKxwvKC.exe"2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD50ac84f782a5ebd194663f2a49523c074
SHA1d0385f6637631709571fca22c1e18e17929048da
SHA2566bbcf312dc5ed80261937b8ce3147a108088af13cbb671de09c483a34a6d3b59
SHA512a8ee8628e3cb0778e7b0787a232e36839f63604163ae79c17c45f7121811c644751bd75e2f829a54c598ace829852b5a3e5d02cab61c39334b595a5d82282d3e
-
Filesize
270KB
MD5733fb94f91b9da25e0e97decd794dd01
SHA12c883fa5284f292f71f158a2fed20824a0e2860e
SHA256390fe36f1a6b919e2e01e585390789bc6151578d3d438c098c6deae2af15ec50
SHA512a0865c521b56124922ef55f94ec4ad963e8a9826c3ea0f4c2b852f5419057268d927c10ad352e8b3603e788e8d5ccacee244edc556af5c0745fc9a8637bb92a2
-
Filesize
454KB
MD5ddfbe52e121a54390cd2a4966b3c991b
SHA1e89bb7fdb552627ee6b2cd570351a05e90233f08
SHA256863556ff60232cc0ba03d64e840b802ea35bd8afd0031fce289965445e072917
SHA512c24548ef34d1dc27d3115220fb63640e44d17fb982f2c0f324e98f76fef0a878d9cd653f935e9f8cdf080f399bfddd431a92da1110126a9a506b3d062fd73478
-
Filesize
17.0MB
-
Filesize
2.2MB
-
Filesize
21.0MB
-
Filesize
2.2MB