Analysis

  • max time kernel
    135s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 23:36

General

  • Target

    dadaac83ffb6674a48a5e0a434716da9120da968e25e2393faec61c68c80b346.exe

  • Size

    3.0MB

  • MD5

    e044a29cd117bb7cbcf632fb2eaa81fd

  • SHA1

    f3a1d4866ac0156da3e545a9e181ba94c4d4fc91

  • SHA256

    dadaac83ffb6674a48a5e0a434716da9120da968e25e2393faec61c68c80b346

  • SHA512

    8b3b2858664aadc786b0eb3e9ebed6526d12a231d8e4539dbc962a445325b3c6b143aaf93e29c6fa4fa959af1324cd06f0aa419aec1e2c46c343210151966255

  • SSDEEP

    49152:KMKgb9TR6PeMRFr5KdDeB4scfWRRpilPEpNW9Nsazgiw9mAGenGijWg6OeCcAbd0:XKcQRF9EkcfWRRclPEzPFiwr3GsuYJ6t

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dadaac83ffb6674a48a5e0a434716da9120da968e25e2393faec61c68c80b346.exe
    "C:\Users\Admin\AppData\Local\Temp\dadaac83ffb6674a48a5e0a434716da9120da968e25e2393faec61c68c80b346.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of WriteProcessMemory
    PID:676
    • C:\Users\Admin\AppData\Local\Temp\SD_EF53\SDExtClient.exe
      "C:\Users\Admin\AppData\Local\Temp\SD_EF53\SDExtClient.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:972
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 676 -s 1064
      2⤵
      • Program crash
      PID:1944
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 676 -ip 676
    1⤵
      PID:2708
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8
      1⤵
        PID:4004

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\DecresePrint.exe

        Filesize

        314KB

        MD5

        b3603b9b5388f6ac61b54bf478b5c969

        SHA1

        9746d6e5749ae45a0d50bb65bfb8b64645da55e3

        SHA256

        428b983c0b0b12f8fb8422408b0e7094f01b7ce11b807d353bbd17bb68133f30

        SHA512

        bb5f14ec32e3a5b8c3d168c966f2a6f2bb5b66c50330cf4667316c38b4f2e856425dd48770a6c5e398cfe6b8d066db931fa4e6be120e988ed65273b0e1a06ced

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\ExePath.ini

        Filesize

        116B

        MD5

        6dd2aa18e2ebe2390a77cc0a4fe0280f

        SHA1

        cefd8fb84fc7c071b221c49b607b1841c7e90f9f

        SHA256

        41988862188d5e35031843dcd26d10656a83a5062a4e38e2d1c18fb46a01980b

        SHA512

        b2e385cc9d1cfa627a31a1ad5e6aba94c83ec6730156b8424715bcb87019d7d75adef43dc17376a8e367e2c8d30d7b2c3e7a06221133bdfab779ebeb77b527c8

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\FSPFileOut.dll

        Filesize

        50KB

        MD5

        0310cfe97fafd9392c8926241a54002a

        SHA1

        35adc58c9c6c897a6f5d4c3b805324d970ff98dc

        SHA256

        e9c27d7e6585626bff5f021a88ae295e78bbbbef573ba6787dd241457acf9c6c

        SHA512

        ba37f45676fea851e2af585c884f942d030d2e97fee63b05bfc3820b7612fd7c10f77b2018a11ab6eb985160c04104a842a7021ed43115e46d79194e4321537b

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\FSPFileOut.sys

        Filesize

        21KB

        MD5

        c7046e9d79dad56500c7f01ea9b50317

        SHA1

        dcac96f3327f0a6f42de883dfab4ae6f4c4ed4f6

        SHA256

        c99863b250e9308ff2ba47e88dd5caad9c2e119e9a17ace88bb2a7bc7153c43c

        SHA512

        26656cf83951da906fef954cb85919560888d5a4dc6fedff1a9876c654f2167a2851f85c203fb1da0bdab8d70d1e25194d26cb57031771d921ae606a480e3222

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\FSPFileOut64.sys

        Filesize

        24KB

        MD5

        281fa560240cded410a958faab4f3a81

        SHA1

        73eefc8baa4cb8625fd177356607ca0a7539cbc5

        SHA256

        4f795529d7b886b694e437c4793fbb20c2b039e8a8cd881f12b53755743e9f23

        SHA512

        7ec626936e20f509e97defb61caeb5ff1f42e2c2a299c15af15f47107a078025d63fdd7310feba036ca1918dd0ae8359887dc8a0c83d5a25049a4b44fe95f410

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\FSP_PrintLimit.dll

        Filesize

        218KB

        MD5

        d5b3279eb9b8058bcdd88a82d522979e

        SHA1

        e90d0290ed8eed045db3b9c7cd1235bd2531e168

        SHA256

        6f858a704d9840781e50e8b2af73e48a881fed3b67b88563026da90497f05e33

        SHA512

        d79f046319558d162a4fcab70737d7045ea0bececa88a19d074271144619f9237cbd0dc41b19e09c853fdab03817f20314c5330082a44d0cb8a09ef22a464a96

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\FSP_PrintLimit64.dll

        Filesize

        253KB

        MD5

        8c0fe4eb0c0566dc6b578abf504c8e4f

        SHA1

        f41f6e69101cb9e84835488dc3c4069db263d631

        SHA256

        299f0fa7f59a7f3ca7ecbe08db3a9570d3d1cec95d4b787275ccd75c029ca2ab

        SHA512

        5d7ad2b666a666e9b7f5ce6c95dab1f811a957d0917597f353c00a830b65f2f1b0924eee170f06514b34e843b0b3b98f9857329fcdd4c7abf58298ef0b4708cd

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\FileRedirectEx.dll

        Filesize

        89KB

        MD5

        5b0f4c573d35c3818e74305c93e3be29

        SHA1

        e3b8cac63edae3ada8e5e32eb64ac37c52c195b2

        SHA256

        49f9135dddd740f8c21e30f81fbc8be7ca05df08304c4ef62b40da21f99a8bd7

        SHA512

        8a67d5353ce1bc7666d1cb33034c6d28d4fd2efb01855af74d3cc1057bdb9b5e68496b35276012fa5616b49d38962b7a7f17a93d60e0ff4ee63f63d4597549ed

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\Fsp_Notice.dll

        Filesize

        531KB

        MD5

        16ddd1e7aec3b76b06ad46c34c869ef5

        SHA1

        c65d196c9d310f9e3733d7d726a5cbbefd4404d0

        SHA256

        3e7a3c2d7483fbbb93eae2c87feb5dd7e25f73edd31612aaa7966ad364a6be4d

        SHA512

        d06d7a975535b7ec8062fd8a9a5e6524c01f31fe4161ada02182f21e3a6c6711f3e4ea23d5930758527ef3db4f23f1d6170f2bd664542887db14b336a3acbc34

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\ImpControl.dll

        Filesize

        37KB

        MD5

        e88bfbe7e63480f1e69769384e918578

        SHA1

        96ccd80e5d28acbb528da416ec7f30b4138306f9

        SHA256

        226d470e7cfcd5e319a3c1a610f3c7e9b6d26377af902c9b73fc6f30097be634

        SHA512

        90fc5327774c1e382793deb53fdf9ae58aa66186c4ed68723a38b0e4399c3d733ddb8aafcbbbc946e9a86ea82c6285201e2861300537cb4044de4b9cd31ffc06

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\LoaderInterface.dll

        Filesize

        60KB

        MD5

        f5f001ca8cdac172286ffaeaf1ab4e13

        SHA1

        e89b2b326084a286ea57aa76ed0138baf9d6c9a6

        SHA256

        cd85db8ae064cc14c38892ca632073a7d9d1880abc08c5854bfb3d89f83f7eef

        SHA512

        f98446e039e6f788dc2bc8b24cecb40c53fded01d6a08aec12f18977df0fde566cafaeec3db26c1b5c4d23de28194656985e958b14c1b02bb91c969f104e7a59

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\SDCommon.dll

        Filesize

        71KB

        MD5

        e21b7c64b236181645ea7e3d26e7a928

        SHA1

        c73c82ce09f10e3604c0c12fe5e13f0a51c921b5

        SHA256

        37d14827cf93ba1cad060c8c5c0d2576d96d9230efb1201b7cc19f98d6020b0c

        SHA512

        55e2440c968593e6bcc5586c81bff9a2a6516b0a99ddec3ef2e07afc03a384ec5a00dd1d48106f881ebeb1a1a418cb3d255ba665ddc27d80026a66c936e0a94f

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\SDCommonEx.dll

        Filesize

        199KB

        MD5

        534ebb974cabdb64b5503b4727877024

        SHA1

        bc571ac14dadbf43770d68facca2b0953cd9ed05

        SHA256

        748aa576deffe0b93a5e446d01e53cddf52d38bf6a6ea6252d636326e7a4340b

        SHA512

        51a6a2d0b2b283faeffeaf3879d84ab37b72916b951eb41f9439a2486fef135c0c91f539541d158e63e2393a1ba5370075bf8e586ee38d82e9a4b1d7b2ec0207

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\SDExtClient.exe

        Filesize

        2.9MB

        MD5

        c2b721bf5ba2e41588304d553bfa3466

        SHA1

        b6a09708706112871d795a2b4d8ba8f85f667fab

        SHA256

        bdaff354d371b36595e2007fdbb8e2bce270a581a2bb2fec9d5b7bd02491e103

        SHA512

        b37344c1a24eee2c1e5971e26a735bc430db62783485f494b9d7147ac9855d36613a4c511f4d26d5d5c03fe0b8ddc8156f66892b982298b3b7b722f4d558d3a4

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\SDExtPolicy.lst

        Filesize

        2KB

        MD5

        5fdb9a12bd3eab5cefc58a122f4aae05

        SHA1

        8d3b101e23f705088ae15beb1e2858200967ff6a

        SHA256

        5d134463a3682e9c59b2865f431c73a8316829f77bce4f53c81ae681b69be2fc

        SHA512

        1e93c5bc3d32b84ae07eb982e92e1e72ea3b34007b35bf595562596fa2522d7b69bce0b73ac95301cc0d6cf03751754dbe2861cbbc274f574273ca50b82cc71f

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\SDOutHook.dll

        Filesize

        280KB

        MD5

        1597f8b1850b7825ade925131c3b297a

        SHA1

        a06ed3b96436435c19f953f2aadc325d8d98bf19

        SHA256

        569dd83805efd18da118e14b81bd384fab5a5d257383302510f65787bfdc8f62

        SHA512

        a58a8f7205b4275d81e02bbd8dd84ded198c38a84c9e32352178220f7b7bcdc7d5326d64460089dc53b16d3e2bb1a918bf80755f4a7a4b0a467ac4aafe0f1730

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\SDOutHook64.dll

        Filesize

        311KB

        MD5

        ee5d0fc12329b6b6b2d8b0edb6c56078

        SHA1

        a321cb9068180a419e535c1c6df25937d9514ffe

        SHA256

        cc3d3baa9e5c6cd2d47ab8bfa96ebb79d48ee9386a202d2c672f81358cccc201

        SHA512

        9d180aa04086279aeb83f0728f53b9ea65639220d0f365bab6c16e8f2706333f69fcf964db564cbe8b68569ad300a9f75966d32d10020a2241b898aeed6d38f2

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\SDOutHookLoader.exe

        Filesize

        85KB

        MD5

        74fb536b7d928ab6baf698fb44922a9f

        SHA1

        a597e9d4f1d66097e7e20dbe46207d255e6722af

        SHA256

        1fab3a8b8e043aa91c17316927396e647d757c7705a3ad724c68de5546793876

        SHA512

        6ced3265556731748640332e7192bd18cfd5a78f363afc41bb30e283372173adef041c5dd4243c221f95eadf51864c1a63d9975394f2abedb46f470aa78f9bd5

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\SDOutHookLoader64.exe

        Filesize

        94KB

        MD5

        9a9678b6a44ad0187bdf44482261cbfb

        SHA1

        b349453262d332703c9036965f10fad9b49b2ce3

        SHA256

        8e6a8424173c14a7b897f1af8385578c9c8ce1887c708a9999b37b82b1ae4ce7

        SHA512

        8c7fd316d5361f4e5c0dadeea9b5f9d2aa554c319d8438852a20f59073d38386d92132dfada3365311fc13f31cd4f9f62ef1ce3436bb43e1e8194d854a5dee6c

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\SD_AssistP.dll

        Filesize

        76KB

        MD5

        b3f3758a563104345e37498579f91e39

        SHA1

        e4130c49b342dd6aa8bba85ba89d6d519ed1a194

        SHA256

        05bd3f7342b60405a37da0ad0f7f68a6a7cc9ab5482747fad08e8fdfb2f7a9b9

        SHA512

        67e104d1e99b31b601c69354e4b2f562e01e7ac37305043c93f85b852a9befd6ccd2aef9736f2c1509ef823ccd78361cff0612236ea7a27a4daf9ead9e731ad1

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\SelfExtract.exe

        Filesize

        1004KB

        MD5

        8bdcb2c5a3eb175394deb0d90bcc8263

        SHA1

        e6f8aa5332a989e69c246ba78f6783c58ac4cfa4

        SHA256

        859b923457c7c084008e2fcf75e6dd309f24d1b3f93514c08e73d9469fccddd6

        SHA512

        94310458b6b165192b61dfd1cbdb9e87e05e2d704464b143a39773f9838a5db967954a7c0d2c03a0e258ecd62932875533b811bea5d1d99e57a2cc0d8e40832b

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\csp_crypto_dll.dll

        Filesize

        76KB

        MD5

        c644949671ca7e0c5055207a0a4c45ab

        SHA1

        523705caa026c77b082c25d6c5b64d0e3fd6d2ee

        SHA256

        30d763349c73cd39411406fa2f4aab5edda2394b9d8e200a7df86d1e39cecc0f

        SHA512

        7260574b09a059e45c06f62c9166858a42d37d1ca54a2f7cda2de2d6dafad44923bbf7649cb213e026ea3f6f74479514c0badb6f954e1e534c1dfd465608ccd4

      • C:\Users\Admin\AppData\Local\Temp\SD_EF53\csp_soft.dll

        Filesize

        136KB

        MD5

        a7c97559d7137d256c4df9725fbd30db

        SHA1

        b66a0d1308d532bfa5b766a9aa7922c1d71a436f

        SHA256

        fdac77981aa42256b881f29365079801385fce16d5a095e8321611cb22480eb5

        SHA512

        fdf7c804b139b88e80defd2fd6dd015acadecad267c9330ba23bdf0b47197cc6a1a185b4cc14eee6c45a942630036db736081e1db578dc6dcb454454811dc762

      • C:\Users\Admin\AppData\Local\Temp\evbEF52.tmp

        Filesize

        1KB

        MD5

        607f71634812be52285b38bf5e1045da

        SHA1

        fc6c1be4daf417a58528441f9d8f4e3deef5a729

        SHA256

        8473b73da507b05ce3bf000c831f9e4227a8efbae8df2ff774bebd4932ab2bb5

        SHA512

        dde318c9852827cc65079a2921d2bf47691d670421946426e59f98066f018266119b728da5bb77d311274e689004e99786e3edf1edb315178652eda161bc4b5f

      • memory/676-0-0x0000000000400000-0x0000000000475000-memory.dmp

        Filesize

        468KB

      • memory/676-14-0x0000000010000000-0x0000000010038000-memory.dmp

        Filesize

        224KB

      • memory/676-10-0x0000000077522000-0x0000000077523000-memory.dmp

        Filesize

        4KB

      • memory/676-11-0x0000000077523000-0x0000000077524000-memory.dmp

        Filesize

        4KB

      • memory/676-4-0x0000000010000000-0x0000000010038000-memory.dmp

        Filesize

        224KB

      • memory/676-107-0x0000000010000000-0x0000000010038000-memory.dmp

        Filesize

        224KB

      • memory/676-106-0x0000000000400000-0x0000000000475000-memory.dmp

        Filesize

        468KB