Overview

overview

10

Static

static

10

NewB.exe

windows7-x64

10

NewB.exe

windows10-2004-x64

7

Resubmissions

27/04/2024, 16:20

240427-ts8eksch5310

27/04/2024, 16:16

240427-tq712add81

Analysis

  • max time kernel
    94s
  • max time network
    44s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/04/2024, 16:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    NewB.exe
  • Size 418KB
  • Sample240427-ts8eksch53
  • SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NewB.exe
    "C:\Users\Admin\AppData\Local\Temp\NewB.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:616
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\NewB.exe" /F
      2⤵
      • Creates scheduled task(s)
      PID:1376
  • C:\Users\Admin\AppData\Local\Temp\NewB.exe
    C:\Users\Admin\AppData\Local\Temp\NewB.exe
    1⤵
      PID:1920
    • C:\Users\Admin\AppData\Local\Temp\NewB.exe
      C:\Users\Admin\AppData\Local\Temp\NewB.exe
      1⤵
        PID:2420

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads