Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 01:18
Static task
static1
Behavioral task
behavioral1
Sample
a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe
Resource
win10v2004-20240508-en
General
-
Target
a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe
-
Size
76KB
-
MD5
18d94ddfe5d614e698b8b982ce4ca56f
-
SHA1
b0584c8257f076e6a70ae18a5dbba59f069ba9a2
-
SHA256
a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83
-
SHA512
d4925fcce730ea8e42313eceae36c9a41fee8b9d91ecf96a33f8dd9506d1d2da242de87e262f7007983589868903f780d2dedf0ad735d439356e3638f5fa062c
-
SSDEEP
768:rxgZvuTrbYJLKmkwW+cBh8mvdgCXGcZDxc7mdKnI/:r1bKLHG+i8HSPZDW
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Admin.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe -
Executes dropped EXE 1 IoCs
pid Process 4588 Admin.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" Admin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 4588 Admin.exe 4588 Admin.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 4588 Admin.exe 4588 Admin.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 4588 Admin.exe 4588 Admin.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 4588 Admin.exe 4588 Admin.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 4588 Admin.exe 4588 Admin.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 4588 Admin.exe 4588 Admin.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 4588 Admin.exe 4588 Admin.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 4588 Admin.exe 4588 Admin.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 4588 Admin.exe 4588 Admin.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 4588 Admin.exe 4588 Admin.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 4588 Admin.exe 4588 Admin.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 4588 Admin.exe 4588 Admin.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 4588 Admin.exe 4588 Admin.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 4588 Admin.exe 4588 Admin.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 4588 Admin.exe 4588 Admin.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 4588 Admin.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3608 wrote to memory of 4588 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 88 PID 3608 wrote to memory of 4588 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 88 PID 3608 wrote to memory of 4588 3608 a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe"C:\Users\Admin\AppData\Local\Temp\a92f7ff1e437840786a132020d2ec00af5a19c1b34d7440f8e7080fd388e6e83.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5975794e0323a23c545362b4b608d5f55
SHA16400b5a4cc0b97ec48ecb1ec2dd295995bd613fb
SHA25608a9dec73cea01d256fe75557f6196ede1af0fa4f232e1f41625dffd10dee7f7
SHA5128b0b9a01b4e57c63eeb194acbdf93531d224c701fa25da5f854c6b086c90adf19b37489cd27d2e4cec678d4c66b51c775044ca042b488ff26b3c85d09d1c21b7