Overview

overview

10

Static

static

3

39fb7dc3b2...33.exe

windows7-x64

10

39fb7dc3b2...33.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/04/2024, 20:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    39fb7dc3b206876907e1053adc0fb542c021e7500a4313766e06eda4e4b2e133.exe

  • Size

    212KB

  • MD5

    d8595611b3070b80f6c85f46cdb8ca00

  • SHA1

    be7f3b2368890cb661e50db380d997c6fbe4b565

  • SHA256

    39fb7dc3b206876907e1053adc0fb542c021e7500a4313766e06eda4e4b2e133

  • SHA512

    f1243ff1c16942c5b26a4b2ab286762b1a4853bfde5feb2e0ad40ddeabb1c3c10999981aa11dfb236bae5e5a37277fd0810ed7013eebe25d26a7d9b85b5cef55

  • SSDEEP

    6144:3sfO2JG4GpRKnvmb7/D26h/xFb8RQF9jwC/tRvPXbyheAg4ZIjJCe5SG:8fOUPURKnvmb7/D26xb8RQF9jwC/TvPz

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 53 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39fb7dc3b206876907e1053adc0fb542c021e7500a4313766e06eda4e4b2e133.exe
    "C:\Users\Admin\AppData\Local\Temp\39fb7dc3b206876907e1053adc0fb542c021e7500a4313766e06eda4e4b2e133.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Users\Admin\clvom.exe
      "C:\Users\Admin\clvom.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\clvom.exe
    Filesize

    212KB

    MD5

    2b27a5be3ff19f9ffff875e41889f27e

    SHA1

    6c7abeeb79aa3dc9dc1570f6e276d3995cf8d6e4

    SHA256

    40aa878b507e424f16dc66a2fa9c97d0bbab7e9167f2465a86c925100fc3c891

    SHA512

    9aeed296edca1d478ef5567de659c4231c9d4e65bb8b62337823fc6405115c8b80345e62f396b28dde397c4a5359c20dbf5adb10d19ea254f3e3e5be2b8d49c7

    Download Submit