Analysis
- max time kernel
153s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
25/05/2024, 01:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe
- Size 40KB
- Sample240525-blt99shf37
- SHA256 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2
- MD5 49d0d7418b0eb7009af6f2bcbdc347cd
- SHA1 9a311d6e709487777da863e57571f8d3b38f9207
- SHA512 061fc171e528fa63d08598a17b1964abecb630d02f6c5f5556307f5cb912a2d1b9889647e46f1be889018f71da8888b89880733cc1abde94e532d9ef32e07833
- SSDEEP 768:f+fko/XiyhMpp8F9bdHXtHs7CQpcdHoCCvc:f1khM38F95NWee1vc
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Admin.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe - Executes dropped EXE 1 IoCs
pid Process 4444 Admin.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" Admin.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 4444 Admin.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 824 wrote to memory of 4444 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 90 PID 824 wrote to memory of 4444 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 90 PID 824 wrote to memory of 4444 824 9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe"C:\Users\Admin\AppData\Local\Temp\9a5872645e1b01c7389a2fb86351565c9829e38f55afca3b606ac1447ed81df2.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:81⤵PID:3752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Admin.exe
- Size 40KB
- SHA256 6568dd76eee1436e737195e3a4933b0c7853c6b535b2ebdfabb7c563e3d0154c
- MD5 9f5de7c5fd051f2a77f345b0bba2e552
- SHA1 a5f0fc3d2267ee53efee3e16762126967960c647
- SHA512 48851e4efc64b9103f36d7bdbd6ccf80a158d6bb2491aabeea1bd403c842f09501a4fa56c69f7fcaefa37f14deed3d00753d3bfc58595ecf42f01b1351dc8daa
- SSDEEP 768:4bfko/XG/LQHp8F9bdHXtHs7CQpcdHoCCvc:4opL88F95NWee1vc
- MD5 SHA1 SHA512 SSDEEP