Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28/04/2024, 19:41
Static task
static1
Behavioral task
behavioral1
Sample
2af13a10920dbcbc8868c84c0b37407051352c97e7891df2e0618f43661ca73c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2af13a10920dbcbc8868c84c0b37407051352c97e7891df2e0618f43661ca73c.exe
Resource
win10v2004-20240419-en
General
-
Target
2af13a10920dbcbc8868c84c0b37407051352c97e7891df2e0618f43661ca73c.exe
-
Size
54KB
-
MD5
4a66e06f397dc0ead3e3e81df49f4123
-
SHA1
72d5e902d80698667b1f0667f9aa57d2d0eaf7a3
-
SHA256
2af13a10920dbcbc8868c84c0b37407051352c97e7891df2e0618f43661ca73c
-
SHA512
c2fad8872322d54150d6e2a5a2acdc8ca1ba5250eef40683a4428454da422752097af05c4ce58c5483cbbce798688f947fe422908d3e7f79061b8f04d4e4ad1e
-
SSDEEP
1536:jvQoLHjw2iWPKMvw71sMLyXugRRRN7TTTgUUU+cccx:jv5Ls27BIJsMLyXui
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule behavioral2/files/0x000c000000023b3d-3.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation 2af13a10920dbcbc8868c84c0b37407051352c97e7891df2e0618f43661ca73c.exe -
Executes dropped EXE 1 IoCs
pid Process 4364 iewhost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Debug\iewhost.exe 2af13a10920dbcbc8868c84c0b37407051352c97e7891df2e0618f43661ca73c.exe File opened for modification C:\Windows\Debug\iewhost.exe 2af13a10920dbcbc8868c84c0b37407051352c97e7891df2e0618f43661ca73c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3548 2af13a10920dbcbc8868c84c0b37407051352c97e7891df2e0618f43661ca73c.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3548 wrote to memory of 4932 3548 2af13a10920dbcbc8868c84c0b37407051352c97e7891df2e0618f43661ca73c.exe 88 PID 3548 wrote to memory of 4932 3548 2af13a10920dbcbc8868c84c0b37407051352c97e7891df2e0618f43661ca73c.exe 88 PID 3548 wrote to memory of 4932 3548 2af13a10920dbcbc8868c84c0b37407051352c97e7891df2e0618f43661ca73c.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2af13a10920dbcbc8868c84c0b37407051352c97e7891df2e0618f43661ca73c.exe"C:\Users\Admin\AppData\Local\Temp\2af13a10920dbcbc8868c84c0b37407051352c97e7891df2e0618f43661ca73c.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2AF13A~1.EXE > nul2⤵PID:4932
-
-
C:\Windows\Debug\iewhost.exeC:\Windows\Debug\iewhost.exe1⤵
- Executes dropped EXE
PID:4364
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD5a7e223d1198e17407650cfb2ce91a2f5
SHA11e13ae64022a82cbb4303e1690591cd2d17b1c0e
SHA256570bb6b4e80a0fdecc0b842358495aee6e0c7d8d54f2a6e1d81ff02e979ba077
SHA512e668e569e414afec039f4c6fa50cb2e5262b86fba92cde7368349732d5db80c074e5e203f104400aeb085d961b97baffb3ef3587fc759f3ab39e65c6b519178a