Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 00:10

General

  • Target

    8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be.exe

  • Size

    18KB

  • MD5

    9b28f0a393a2b5879a54e0f83987deb0

  • SHA1

    8a3b0583fd92fbbb85e85ebc4018ad693e9df26f

  • SHA256

    8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be

  • SHA512

    9bf94e44e33f6714146aced24b8505ca801499b9ba62f00a46a309d32f22330f45fa522e7d1840bf8b8f984937e86cfd6e9faf09323f8cc85061ec4a003c9d10

  • SSDEEP

    384:r6eHIAx0pqNgHvRtoyhAkeKE7pDKbR6hcdBYpBmLE:r6eHIMgPRtzykeKE7pkRpTE

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be.exe
    "C:\Users\Admin\AppData\Local\Temp\8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AOXOC.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3600
      • C:\Windows\SysWOW64\reg.exe
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Ineter Mc" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\trys.exe" /f
        3⤵
        • Adds Run key to start application
        PID:4816
    • C:\Users\Admin\AppData\Roaming\trys.exe
      "C:\Users\Admin\AppData\Roaming\trys.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4748

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\AOXOC.txt

    Filesize

    135B

    MD5

    6dbb2090ff90500da05a027765cde190

    SHA1

    425b833d9d1df8d6df6e5a59f738058808271949

    SHA256

    71ca0761f7187f2164f62b23d5d9d2dcfd28d9ab9a8dfc14796c3ac06db03881

    SHA512

    7e4679e04bd5a69c026949a0d2760a630bc02249a04f3bd224dee41d1bf10f0a29e45812a67c583327a63e5401f0ff2aa9a3f4df8233b150943052c97e861ab3

  • C:\Users\Admin\AppData\Roaming\trys.exe

    Filesize

    18KB

    MD5

    6e16b64219df837afd7df95761289d5c

    SHA1

    90ac6932dbd752b3c6bf062d7e78a191a911d07e

    SHA256

    6c8aaca186c760a71faeb29abab1e727118ed944bd44b99cae81418c14b69925

    SHA512

    7dca3b82bcbd0f477b59d1637843e60c7f88b687d6c2925a81f36943b355351e7cb3f13a2a4b633ddec42bdc77437474475fa229f9aa78b28dd7a07e8ba39426

  • memory/2684-0-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2684-27-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/4748-24-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/4748-28-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB