Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 23:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe
- Size 40KB
- Sample240613-21k81sthpc
- SHA256 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b
- MD5 755989f2097357a12ed4a527bab404be
- SHA1 bbaf861ecdca0c961e925de27ab210ae921aebbb
- SHA512 80f5f74e3fdf467b465690f364e1ee58f35a984e8791c58b023fae42c534e5aaa639f3406ba11b2327fab2f8581b77da21fbcdef87f09aa60bc6f45eb0f3ebd7
- SSDEEP 768:fSPXwaMzER7o5PBsTBkbHrHXd4fCJcEHwzOx0vc:fqbR0bsTB4bqh1vc
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Admin.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe - Executes dropped EXE 1 IoCs
pid Process 2852 Admin.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" Admin.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe 2852 Admin.exe 2852 Admin.exe 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe 2852 Admin.exe 2852 Admin.exe 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe 2852 Admin.exe 2852 Admin.exe 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe 2852 Admin.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4564 wrote to memory of 2852 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe 85 PID 4564 wrote to memory of 2852 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe 85 PID 4564 wrote to memory of 2852 4564 5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe"C:\Users\Admin\AppData\Local\Temp\5624a9df7ab849063046769115d89ea958f45e4c9f23657b3b4b12d015ff549b.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Admin.exe
- Size 40KB
- SHA256 cdf8498d3c91680cf4177def7011fb2db64c7628436c0646800ef845e46ad33f
- MD5 7a6162a9b2b243a3f1df0572710201c6
- SHA1 fcab6988bfee735de21ad396c27c80bce2690cfa
- SHA512 55179f1dd24e51505563dceeb869c8f95a2b78b465660f8e18f39adc95b939c2f767d32b3ea96f25eaafab767364fc0820415cc1ea1b7aca15e99e58ae1105b9
- SSDEEP 768:WTPXwaczlGWIXA5BsTBkbHrHXd4fCJcEHwzOx0vc:WrKGXssTB4bqh1vc
- MD5 SHA1 SHA512 SSDEEP