Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 13:44
Behavioral task
behavioral1
Sample
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
Resource
win10v2004-20240412-en
General
-
Target
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
-
Size
483KB
-
MD5
06f5b8dffc6c138828adbc7f29cfc7f0
-
SHA1
b59ef5d613a1e49c7034c3ee05780ce054ca0054
-
SHA256
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7
-
SHA512
e706a0b3b1981cac8ddcf81482b306b4538fbfbf5c332f2b484f8c503b66d73cd09ffaab0515ecb2063d1e4a27dc30a662cc0be4f5287d2982cfbb47c7dad893
-
SSDEEP
6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNx5Gv:aX7tPMK8ctGe4Dzl4h2QnuPs/ZDIcv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe -
Executes dropped EXE 1 IoCs
Processes:
svcs.exepid process 208 svcs.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exesvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\svcs.exe\"" 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\svcs.exe\"" 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\svcs.exe\"" svcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\svcs.exe\"" svcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svcs.exepid process 208 svcs.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exedescription pid process target process PID 1280 wrote to memory of 208 1280 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe svcs.exe PID 1280 wrote to memory of 208 1280 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe svcs.exe PID 1280 wrote to memory of 208 1280 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe svcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe"C:\Users\Admin\AppData\Local\Temp\03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\microsofts\svcs.exe"C:\Users\Admin\AppData\Roaming\microsofts\svcs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\logsa\logs.datFilesize
144B
MD539cf4e3e186e83aef73cc0f7c2cc346f
SHA1e937bed9f6840139c57f028a1de0bb9cf3e092a6
SHA256af461a45825e7ba9f73889c65199948039ee3a71efe45430fecdca1d067fad88
SHA5126002534f986f8c77513aee508f0484d90af8f90a555251e5391c50a9079c6173d1bcf050d703c8718773da30f3f87b28d0d1e5f91978f7d5f3528af1ddb54484
-
C:\Users\Admin\AppData\Roaming\microsofts\svcs.exeFilesize
483KB
MD506f5b8dffc6c138828adbc7f29cfc7f0
SHA1b59ef5d613a1e49c7034c3ee05780ce054ca0054
SHA25603ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7
SHA512e706a0b3b1981cac8ddcf81482b306b4538fbfbf5c332f2b484f8c503b66d73cd09ffaab0515ecb2063d1e4a27dc30a662cc0be4f5287d2982cfbb47c7dad893