Analysis
-
max time kernel
151s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 13:13
Behavioral task
behavioral1
Sample
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
Resource
win10v2004-20240412-en
General
-
Target
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
-
Size
483KB
-
MD5
06f5b8dffc6c138828adbc7f29cfc7f0
-
SHA1
b59ef5d613a1e49c7034c3ee05780ce054ca0054
-
SHA256
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7
-
SHA512
e706a0b3b1981cac8ddcf81482b306b4538fbfbf5c332f2b484f8c503b66d73cd09ffaab0515ecb2063d1e4a27dc30a662cc0be4f5287d2982cfbb47c7dad893
-
SSDEEP
6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNx5Gv:aX7tPMK8ctGe4Dzl4h2QnuPs/ZDIcv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe -
Executes dropped EXE 1 IoCs
Processes:
svcs.exepid process 1228 svcs.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exesvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\svcs.exe\"" 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\svcs.exe\"" 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe Set value (str) \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\svcs.exe\"" svcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\svcs.exe\"" svcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svcs.exepid process 1228 svcs.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exedescription pid process target process PID 5048 wrote to memory of 1228 5048 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe svcs.exe PID 5048 wrote to memory of 1228 5048 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe svcs.exe PID 5048 wrote to memory of 1228 5048 03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe svcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe"C:\Users\Admin\AppData\Local\Temp\03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\microsofts\svcs.exe"C:\Users\Admin\AppData\Roaming\microsofts\svcs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\logsa\logs.datFilesize
144B
MD597911e416e2dba8e0f78fcab61145dc1
SHA1f9861d9bd5436c81b6da32d9faf9dd52f30ffd38
SHA256432d1502730a644b62aaee7da297425351483f8ef3aa24dcce55a3fb1c293caa
SHA512f3bbea7a84204da556a9f091dd1e0198073ece3d0a5818da9739e3127c09675053ba2bd55fd36d44217b994da0506bb506f26e8ed47a5533ef5ccf2d70ad835a
-
C:\Users\Admin\AppData\Roaming\microsofts\svcs.exeFilesize
483KB
MD506f5b8dffc6c138828adbc7f29cfc7f0
SHA1b59ef5d613a1e49c7034c3ee05780ce054ca0054
SHA25603ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7
SHA512e706a0b3b1981cac8ddcf81482b306b4538fbfbf5c332f2b484f8c503b66d73cd09ffaab0515ecb2063d1e4a27dc30a662cc0be4f5287d2982cfbb47c7dad893