Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 18:46
Static task
static1
Behavioral task
behavioral1
Sample
05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c.exe
Resource
win10v2004-20240611-en
General
-
Target
05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c.exe
-
Size
37KB
-
MD5
d0547354634061d7a51e060809976e46
-
SHA1
3747abeae329ebb5bbd2054ca8e1ca7dbabc7d4c
-
SHA256
05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c
-
SHA512
12989541384b37352d1e412f2e8257c1a59cf92a76615f59855c80f4b580cbb4e7998c97735f891a15f9dc8f5d39b7a08bb8c93a670ac15147a749d2ec5df5a0
-
SSDEEP
384:JC+EaVVpDSL/7wIUAch1A9NB/erdO9oMCCQcxbRxla0rh84KtI3/w9netgKzU7/P:JSfL/76As1FdMQ8RjaeeILtQhRSSDSIz
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c.exeopera_autoupdater.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation 05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c.exe Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation opera_autoupdater.exe -
Executes dropped EXE 1 IoCs
Processes:
opera_autoupdater.exepid process 216 opera_autoupdater.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c.exedescription pid process target process PID 4320 wrote to memory of 216 4320 05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c.exe opera_autoupdater.exe PID 4320 wrote to memory of 216 4320 05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c.exe opera_autoupdater.exe PID 4320 wrote to memory of 216 4320 05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c.exe opera_autoupdater.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c.exe"C:\Users\Admin\AppData\Local\Temp\05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\opera_autoupdater.exe"C:\Users\Admin\AppData\Local\Temp\opera_autoupdater.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD547ae4aa285603bc6ec800348cba7fc62
SHA1483ede8229090eae61d276d8e584de8f40777efe
SHA2561293cafefb327e01e0ba785c16c293ef022736095e79e32908cfac34e5e22e01
SHA512fd5558d2349fff5d1a3e06ef98a08abcd797dcbb9c3fbd65216fe0ecae7082ec39da7dd56e87fab649928267f8081b3333cade09ceeba34af207dd8d14f0cb13