Overview

overview

10

Static

static

3

2da71a8bc8...0N.exe

windows7-x64

10

2da71a8bc8...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2024, 00:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2da71a8bc8d4bd13349641d9864e21d0N.exe

  • Size

    31KB

  • MD5

    2da71a8bc8d4bd13349641d9864e21d0

  • SHA1

    c40e89cc52aee8167a0db7ac0e3977bbf677db68

  • SHA256

    d02b238c7e0fd6a45a0a0739fee2a527e89e4154bce704baab534f051d8a196b

  • SHA512

    5c7593890d3d61a2ac11bf7d908174d216f75c853c059a0a0f52f793227749e12413eadb9424751140240169d8a8b8c37b5d507446a149302d3657e593a998d5

  • SSDEEP

    768:9lneDDzFOeS7mjGU8zHTHXzXHCzcsHizTxavc:9lnEHdjGU4j5j0vc

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2da71a8bc8d4bd13349641d9864e21d0N.exe
    "C:\Users\Admin\AppData\Local\Temp\2da71a8bc8d4bd13349641d9864e21d0N.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4920
    • C:\Users\Admin\Admin.exe
      "C:\Users\Admin\Admin.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4980

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Admin.exe
    Filesize

    31KB

    MD5

    d713f68039330a01ca19a5235423cba2

    SHA1

    1e9c8c69d27528807c36a02b77a0c87ea5126ed1

    SHA256

    9db4e9c28507a48087c8527047b0c7f15f8596e15cab84ddcfb00808213d2207

    SHA512

    530693f318ad8dae6501d4f60d1627ed8c8d511367b071b8db4822f97ba2fe54f739bebea8c0bfc1453e725b81ad4cb74887cf373757bb78723a9172ff593991

    Download Submit

  • memory/4920-0-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/4980-33-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download