Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 15:43
General
-
Target
1428-90-0x00000000004D0000-0x00000000004DC000-memory.exe
-
Size
48KB
-
MD5
201fcb317da055d1a3c50055b20612fa
-
SHA1
54ff456107efc569d9e0f4472c94c582f6eebd11
-
SHA256
404ddbce422f18a4f342ff53b1114c7c30b6d35474b8e9082ccf6b120936f786
-
SHA512
87d2791541a2b54f6a5c6535f48cf03c6a91183ced133682ade3eb634c2ada9cda7dd3e72f5c81e41354fe6c0c36b39d51e3335ea06dcbb6947f5cdd32c9ae6d
-
SSDEEP
384:TqbjqhfPjAPYQMWSN4hxMEcBXugc2mMTAKZqP+xcV+ocGJN8/S3MqkvzghX:+nqdqJSwr44/EqioSKBmM
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1428-90-0x00000000004D0000-0x00000000004DC000-memory.exe"C:\Users\Admin\AppData\Local\Temp\1428-90-0x00000000004D0000-0x00000000004DC000-memory.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" "explorer.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5201fcb317da055d1a3c50055b20612fa
SHA154ff456107efc569d9e0f4472c94c582f6eebd11
SHA256404ddbce422f18a4f342ff53b1114c7c30b6d35474b8e9082ccf6b120936f786
SHA51287d2791541a2b54f6a5c6535f48cf03c6a91183ced133682ade3eb634c2ada9cda7dd3e72f5c81e41354fe6c0c36b39d51e3335ea06dcbb6947f5cdd32c9ae6d
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB