Analysis
-
max time kernel
140s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
22-04-2024 23:44
General
-
Target
75ddeb62e1684dec3afe4775a0f88493259c60cccd8506d05223b4719a2e70aa.exe
-
Size
409KB
-
MD5
095d9e6e0d472d3c91ec718b33009dce
-
SHA1
e98990a6bc24b276b669b45edf1d1a6f570e0a7a
-
SHA256
75ddeb62e1684dec3afe4775a0f88493259c60cccd8506d05223b4719a2e70aa
-
SHA512
31f1847f2662ee91eeee40a7d689d0a04a80d8b63e23f6a8a46056f20df7b3c23317789cc9956fa2f17dd687c38ee619181a5aa888f842875e23da76dc326381
-
SSDEEP
6144:ho+k6sXkPV9WBtpypFBK4Tu/6oIx6SCxHlugp6QcHul5CTVhUgPbg+vPLsHEF:GrWcDkpFBK4Tu2xYHlB6HHggTHVP8i4q
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75ddeb62e1684dec3afe4775a0f88493259c60cccd8506d05223b4719a2e70aa.exe"C:\Users\Admin\AppData\Local\Temp\75ddeb62e1684dec3afe4775a0f88493259c60cccd8506d05223b4719a2e70aa.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\75ddeb62e1684dec3afe4775a0f88493259c60cccd8506d05223b4719a2e70aa.exe E40394C79B00C62EBD1E0227594279EDA3B968C009D0C1CC13E6FC895F3CEA86C57DD6A687EC5A8625C4E64619DB209FA8FE4E058D3238B3089CCBA30E498FDA2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\75ddeb62e1684dec3afe4775a0f88493259c60cccd8506d05223b4719a2e70aa.doc" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
409KB
MD53b343bea2b9d47c3975deb91c877e2ad
SHA144a7c6e4b1de26025565f6f6d8bb856d68bb6578
SHA2565808f49b357f71dbd374c482b3d3b6c40e288660b484d662ee4856116766cffb
SHA51268b36390eb8ce08d30e68f9e8a1a1caa09e07784d6f545b61c72058b90a2f7f224955ebe444d8eae855110fc87e10affbc419ccf57b5c66af5900dfc02fe1ae7
-
Filesize
21KB
MD512e57ae08f64353b3c3b3d08681aaaf1
SHA136b6aca282497c65d41513b231d247b0187651f1
SHA25607498e905c47bfea983587265b88eb01bc6098978c375c71074b9469a99b4308
SHA512aba2748b1b5d26f52a93bbfabbd4760435b06d6c449631930e7db339c5317429f59cc24709515707cdda34956c73d30e60b83b81986873eb544b1040388748a8
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB