Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 22:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe
- Size 32KB
- Sample240611-13enkstdrf
- SHA256 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c
- MD5 06e649f252f2b35a262bea227ec3aed5
- SHA1 79bb94a879aed5bfea6bed1aee44f7880deb6244
- SHA512 a90067a89b25e8e384de6b0bf45c90658ec6e2ea3dac1253ac5b3cdc08704a1217d435a017e89d0ccf8123739a99224516d30eb9df2d4df1546d0323fd3fa8bb
- SSDEEP 768:dyzsIdmoIBW+J1Z67otMiANtg9bPHhHXPNWNCB+Gc1H8zHvc:disIdmoIBW+fZ67U8tg9zxB+52Dvc
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Admin.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe - Executes dropped EXE 1 IoCs
pid Process 4428 Admin.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" Admin.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 4428 Admin.exe 4428 Admin.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 4428 Admin.exe 4428 Admin.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 4428 Admin.exe 4428 Admin.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 4428 Admin.exe 4428 Admin.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 4428 Admin.exe 4428 Admin.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 4428 Admin.exe 4428 Admin.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 4428 Admin.exe 4428 Admin.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 4428 Admin.exe 4428 Admin.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 4428 Admin.exe 4428 Admin.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 4428 Admin.exe 4428 Admin.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 4428 Admin.exe 4428 Admin.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 4428 Admin.exe 4428 Admin.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 4428 Admin.exe 4428 Admin.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 4428 Admin.exe 4428 Admin.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 4428 Admin.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2732 wrote to memory of 4428 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 83 PID 2732 wrote to memory of 4428 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 83 PID 2732 wrote to memory of 4428 2732 57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe"C:\Users\Admin\AppData\Local\Temp\57620c7517c186e89e820e810be314c7be26102d55acda5873b754714b111a8c.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4428
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Admin.exe
- Size 32KB
- SHA256 32619db529fc15de7c95f2a0e6276083bf04539afd6b6dccbc28c92a35485bb1
- MD5 995f33cbd03ff810325091e83abbf3c0
- SHA1 0123a93ba823957035cf41cd0309ddaa8713c8df
- SHA512 04cdc5697d3a61ed2cfa2bf68b052b2835835dbdff8aedd62c3a22248b3f6d342894f7dc2ab4cfb74a16e9eda15785d2e188eec26fff54293cd91e66f2a68b51
- SSDEEP 768:zQzsIdmoIBW+91yVPiANtg9bPHhHXPNWNCB+Gc1H8zHvc:zssIdmoIBW+jyV3tg9zxB+52Dvc
- MD5 SHA1 SHA512 SSDEEP