Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 18:46

General

  • Target

    05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c.exe

  • Size

    37KB

  • MD5

    d0547354634061d7a51e060809976e46

  • SHA1

    3747abeae329ebb5bbd2054ca8e1ca7dbabc7d4c

  • SHA256

    05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c

  • SHA512

    12989541384b37352d1e412f2e8257c1a59cf92a76615f59855c80f4b580cbb4e7998c97735f891a15f9dc8f5d39b7a08bb8c93a670ac15147a749d2ec5df5a0

  • SSDEEP

    384:JC+EaVVpDSL/7wIUAch1A9NB/erdO9oMCCQcxbRxla0rh84KtI3/w9netgKzU7/P:JSfL/76As1FdMQ8RjaeeILtQhRSSDSIz

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c.exe
    "C:\Users\Admin\AppData\Local\Temp\05500183ec66c8762732fce77460318f1e3b7bd422fb4c8026fff9a70c055c5c.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4320
    • C:\Users\Admin\AppData\Local\Temp\opera_autoupdater.exe
      "C:\Users\Admin\AppData\Local\Temp\opera_autoupdater.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:216

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\opera_autoupdater.exe

    Filesize

    38KB

    MD5

    47ae4aa285603bc6ec800348cba7fc62

    SHA1

    483ede8229090eae61d276d8e584de8f40777efe

    SHA256

    1293cafefb327e01e0ba785c16c293ef022736095e79e32908cfac34e5e22e01

    SHA512

    fd5558d2349fff5d1a3e06ef98a08abcd797dcbb9c3fbd65216fe0ecae7082ec39da7dd56e87fab649928267f8081b3333cade09ceeba34af207dd8d14f0cb13

  • memory/216-9-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

  • memory/4320-1-0x0000000000402000-0x0000000000403000-memory.dmp

    Filesize

    4KB