Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 03:29
Static task
static1
Behavioral task
behavioral1
Sample
d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe
Resource
win10v2004-20240226-en
General
-
Target
d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe
-
Size
184KB
-
MD5
4beb9268849a50fc0a83b068090653cc
-
SHA1
6f55749d15aa08e39fc3622b48b36f846d1e9772
-
SHA256
d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69
-
SHA512
ed2407c1beeb2f6b9c7d0eeb393bdec431c5a7a0a0aff98eb320e2f6e55bc0011f476156f8c146667d1a44c1e6a6268e7ffe9588fd50d7bd547d4028484caaae
-
SSDEEP
3072:7Ks+1cfl/BTyzcM+Knvmb7/D263i4qMbBQhAKIWOD2r1oX1/hcNcfAUane4RzsUf:2s0ClpTFzKnvmb7/D26y4qMSyKbOD2rR
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" maimit.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe -
Executes dropped EXE 1 IoCs
pid Process 2108 maimit.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /c" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /N" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /T" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /W" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /d" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /l" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /P" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /j" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /A" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /G" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /n" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /E" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /w" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /B" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /g" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /M" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /Y" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /x" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /y" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /z" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /S" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /h" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /r" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /L" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /b" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /m" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /V" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /K" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /R" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /f" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /O" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /D" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /t" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /s" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /a" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /Q" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /k" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /o" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /i" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /s" d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /v" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /X" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /e" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /q" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /Z" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /J" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /u" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /C" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /U" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /H" maimit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maimit = "C:\\Users\\Admin\\maimit.exe /F" maimit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3352 d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe 3352 d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe 2108 maimit.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3352 d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe 2108 maimit.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3352 wrote to memory of 2108 3352 d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe 91 PID 3352 wrote to memory of 2108 3352 d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe 91 PID 3352 wrote to memory of 2108 3352 d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe"C:\Users\Admin\AppData\Local\Temp\d5d4068e75d565763b518b9e7712ca12eb303e2083b668353b668438c84cff69.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\maimit.exe"C:\Users\Admin\maimit.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4440 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵PID:3244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD5ae4cb7e0a0a49e9d3701964607efd08f
SHA1945d1b7191d0c8e902ece3ad2787baf785e1a2ac
SHA256ce114a307f64ca74557dc56f506393c18271a85da1636d248839ea8601bfd914
SHA5127554909e0d6c31123b2f62336acb500cf3ab6467599883edd979086ad2d18ad0da3e4861e94e9772ddf0db7fb34df4da4c4c0e851e465748f64f8d37c3fb9846