Analysis
-
max time kernel
119s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
23-07-2024 10:35
General
-
Target
a64a51ee0344363a615bbf03f7861ad0N.exe
-
Size
72KB
-
MD5
a64a51ee0344363a615bbf03f7861ad0
-
SHA1
3ff1d99a5d0754ee711cb9769a7ed52181eea4e6
-
SHA256
aea6a9fe850338301a9337a4fdd851d0622a804a7d9f5a07b50d9954dfe3125e
-
SHA512
2158ced86c84f571e396ed9a2dc5229f879f45907e8f17277d5a024f978452f2a3d21c6ab558db62fcc17b0e16ad1c0c3343d8cb10954282e16f39a391731ffd
-
SSDEEP
768:1sZSPvhltcHYZjXRIEeVFxhmmvdgZXjYt1NEDIefZsL:10RHCjBuV1mHJMt1y
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a64a51ee0344363a615bbf03f7861ad0N.exe"C:\Users\Admin\AppData\Local\Temp\a64a51ee0344363a615bbf03f7861ad0N.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5df2b9d4bea636acd0f240e4b91221bcb
SHA19f122d3d3c7639c2c4f966b50294daebbf60091d
SHA256dffa83684f4d36a3be1564293b51f3741c8324464e735aabe626dbff628e2540
SHA51270bede5801904bad5d25cf056a38bc6aeffeda94775975a60065193452cd16e6163471bf9fb35b4d3db8d2b6debbea8b5f96c47b62ec2a733357a3136bae14cd
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB