Analysis
- max time kernel
151s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 04:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe
Resource
win7-20240611-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe
- Size 76KB
- Sample240614-exdcnsyepl
- SHA256 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd
- MD5 910298e424ac749d2c9c2cb403bb7d64
- SHA1 c8532b376490482d81bd9eb743ec47d285484df0
- SHA512 fdf6e03db5dd881197a5a8b633a1d60867ca5c45ebb200075273499a67cc73aec72613c89fb69f4276f4092bd86b12c52c3a3ffa49e228ae8116eada6813f773
- SSDEEP 768:fn6Vv4PMnY+1j4I4SccFhqmvdgxXGcZDxc7mdKnI/:fcnV1U2c+qHhPZDW
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Admin.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe - Executes dropped EXE 1 IoCs
pid Process 2192 Admin.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" Admin.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 2192 Admin.exe 2192 Admin.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 2192 Admin.exe 2192 Admin.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 2192 Admin.exe 2192 Admin.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 2192 Admin.exe 2192 Admin.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 2192 Admin.exe 2192 Admin.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 2192 Admin.exe 2192 Admin.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 2192 Admin.exe 2192 Admin.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 2192 Admin.exe 2192 Admin.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 2192 Admin.exe 2192 Admin.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 2192 Admin.exe 2192 Admin.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 2192 Admin.exe 2192 Admin.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 2192 Admin.exe 2192 Admin.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 2192 Admin.exe 2192 Admin.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 2192 Admin.exe 2192 Admin.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 2192 Admin.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3932 wrote to memory of 2192 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 93 PID 3932 wrote to memory of 2192 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 93 PID 3932 wrote to memory of 2192 3932 d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe"C:\Users\Admin\AppData\Local\Temp\d119d6bfe9ef50cbeae6af851d82ca7e7d28c5f439aec528504d88f4962cc3bd.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3648 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵PID:2308
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Admin.exe
- Size 76KB
- SHA256 b00d868a5f693afaaae26e8e2cec8910ecb04fc66e74f36c4fb9a7e0e8d07403
- MD5 d71963103efade3704fb034ca492a1e9
- SHA1 3f736f6fa1476e71a138aae3f4e81eaf1c0be069
- SHA512 43dd7a296762b0c11d4f581a17f421c493734ae44fba88e2d1fa4143a65a383b1e8571e4a8d0031be6197f55191ef8b2fa4763f768b6846c840f5028a098185c
- SSDEEP 768:kI6VvseLMnY+1j4I4SccFhqmvdgxXGcZDxc7mdKnI/:kmnV1U2c+qHhPZDW
- MD5 SHA1 SHA512 SSDEEP