Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 13:08
Behavioral task
behavioral1
Sample
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
Resource
win10v2004-20240412-en
General
-
Target
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
-
Size
483KB
-
MD5
06f5b8dffc6c138828adbc7f29cfc7f0
-
SHA1
b59ef5d613a1e49c7034c3ee05780ce054ca0054
-
SHA256
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7
-
SHA512
e706a0b3b1981cac8ddcf81482b306b4538fbfbf5c332f2b484f8c503b66d73cd09ffaab0515ecb2063d1e4a27dc30a662cc0be4f5287d2982cfbb47c7dad893
-
SSDEEP
6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNx5Gv:aX7tPMK8ctGe4Dzl4h2QnuPs/ZDIcv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe -
Executes dropped EXE 1 IoCs
Processes:
svcs.exepid process 2396 svcs.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exesvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\svcs.exe\"" 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\svcs.exe\"" 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\svcs.exe\"" svcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\svcs.exe\"" svcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svcs.exepid process 2396 svcs.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exedescription pid process target process PID 2644 wrote to memory of 2396 2644 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe svcs.exe PID 2644 wrote to memory of 2396 2644 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe svcs.exe PID 2644 wrote to memory of 2396 2644 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe svcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe"C:\Users\Admin\AppData\Local\Temp\03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\microsofts\svcs.exe"C:\Users\Admin\AppData\Roaming\microsofts\svcs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\logsa\logs.datFilesize
144B
MD53540de355614633dd5a186cb149f1d28
SHA11ee658e8b2520a58782ab07be571c7dff283e5cf
SHA256da7b4f9ab67d66635721dcacca0534ff2f530c3d5c6625ba67cf426a4552cf9b
SHA5123def79d7473a05026fbd0e24c4b3a305827bba18aaf67651c3e11c92e45c7c11831de44ca9e33b583a9a6bbefd96626a041baab1e69b15fb34bcbd6a876c770e
-
C:\Users\Admin\AppData\Roaming\microsofts\svcs.exeFilesize
483KB
MD506f5b8dffc6c138828adbc7f29cfc7f0
SHA1b59ef5d613a1e49c7034c3ee05780ce054ca0054
SHA25603ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7
SHA512e706a0b3b1981cac8ddcf81482b306b4538fbfbf5c332f2b484f8c503b66d73cd09ffaab0515ecb2063d1e4a27dc30a662cc0be4f5287d2982cfbb47c7dad893