Overview

overview

10

Static

static

3

90791353dd...0N.exe

windows7-x64

10

90791353dd...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2024, 11:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    90791353dd1e80fe7025a1d7b0ad6cd0N.exe

  • Size

    40KB

  • MD5

    90791353dd1e80fe7025a1d7b0ad6cd0

  • SHA1

    ab1ea38e1115833e46f67d347b643ee116962df3

  • SHA256

    7026f2ede7859ce605668978dee7ebc9e51dc318e187c95d9c645b7235c19d17

  • SHA512

    8caf8fc0cb8d2d55a36a63b76a0eecca389964d4217e24ef19189df118f6332c9cf38c2f2c0798b06a9963b2f0149b0b6a68b0c8d88784b5c5475c4f977bff57

  • SSDEEP

    768:I7fko/XGmCnxp8F9bdHXtHs7CQpcdHoCCvc:IIcCnP8F95NWee1vc

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90791353dd1e80fe7025a1d7b0ad6cd0N.exe
    "C:\Users\Admin\AppData\Local\Temp\90791353dd1e80fe7025a1d7b0ad6cd0N.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Users\Admin\Admin.exe
      "C:\Users\Admin\Admin.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Admin.exe
    Filesize

    40KB

    MD5

    8cb51f0984c1b8991cec90c9b5ef01a3

    SHA1

    cc47fdd76a4c779734f6463b49836d1308b5cd66

    SHA256

    fe6d8a258e24f67a235ffd3a6b87fd67383aa08b512dd3251559c360cc92c22a

    SHA512

    4fd677b0c221d615871d457097d998db0d7784fd85cc75503c74df8ea4061b19cec1f8dde9a80f4682a526d9fb20dbd721bc9e9cc8f7ff6e737b08dc58dfa49f

    Download Submit