Overview

overview

7

Static

static

3

ae48865bd9...ff.exe

windows7-x64

7

ae48865bd9...ff.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    141s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2024, 00:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ae48865bd983855786a9e0a957d1294f9e94f8cccd90f5270ce8f6b3b0e978ff.exe

  • Size

    197KB

  • MD5

    a1f37507c65ef8c9c6b1b00ffde590ed

  • SHA1

    a3b3ba90ddafe5cbb1c29235af6f21e76c596947

  • SHA256

    ae48865bd983855786a9e0a957d1294f9e94f8cccd90f5270ce8f6b3b0e978ff

  • SHA512

    7000d2c9411f5e7e321a31e2a7b1aff9baaa61bba87049986f8e6a38929175bc8765c28d09a2a66277620e4bab59c0ca4ad1ed291c745b0a0588b8b82b713a83

  • SSDEEP

    6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOD:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXq

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae48865bd983855786a9e0a957d1294f9e94f8cccd90f5270ce8f6b3b0e978ff.exe
    "C:\Users\Admin\AppData\Local\Temp\ae48865bd983855786a9e0a957d1294f9e94f8cccd90f5270ce8f6b3b0e978ff.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3572
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AE4886~1.EXE > nul
      2⤵
        PID:3900
    • C:\Windows\Debug\jkmhost.exe
      C:\Windows\Debug\jkmhost.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      PID:1680

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\debug\jkmhost.exe
      Filesize

      197KB

      MD5

      7b23f344014e8fc0a283116defa588c3

      SHA1

      f0fe6aa51b241ed14f2a61e5678fc587d35bd243

      SHA256

      ade4e45bf493f0a16f2b6d90c84058bab10d1b1f4fde1d4f5019de8ded353ba7

      SHA512

      bb369905412437a50f00b4dee83ec82d0f2c450770e8c74d587fa05c75fc0dd2a6a327725b7c1a06feec25429b8e25750f4dd7023862dfcd80121bf26f6c5a61

      Download Submit