Analysis
-
max time kernel
23s -
max time network
3s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02-08-2024 18:15
General
-
Target
reshacker_setup.exe
-
Size
4.1MB
-
MD5
02eb693dcfb90a696d191badbcf314ce
-
SHA1
b1d0352c35d7da251e2fa19ecbe8c1e5286f898f
-
SHA256
246457363396dcea4cc3d19ce2a431897bac948ae1694d3e87cc0ebaf2ea39f5
-
SHA512
17b6a5f2446459c058bd035df784adad0e58aa7438a56e02fd75c593eb6bae82719b6293de6b1504e1089cade44b5e137771991816d616c08f92eb2c249cc159
-
SSDEEP
98304:HEagQkFrdGj3mx1Ijxkp3U3aVTISLUHBrIC0:9gQktdGCxmjY3U3aVTnIH4
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 23 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\reshacker_setup.exe"C:\Users\Admin\AppData\Local\Temp\reshacker_setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-U48DV.tmp\reshacker_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-U48DV.tmp\reshacker_setup.tmp" /SL5="$602AE,3504386,870400,C:\Users\Admin\AppData\Local\Temp\reshacker_setup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Resource Hacker\ReadMe.txt3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Resource Hacker\ResourceHacker.exe"C:\Program Files (x86)\Resource Hacker\ResourceHacker.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5538f09449b7ffc050fb12c809431032c
SHA199c017570afe0674a4968c687f3a037c6ae6d366
SHA256f0e3b4d80329ceccc0a86b1a8c4c36410245ddb1de3d4ef80cd7db8cf4e59ec8
SHA5124c5bab1c7245f0517f1e0d805ea9e67f765a4de077020d75be319f6fbd17841eb798d654909ccff7bc8c82563ff154f1d619797abf660ce3de0ca5ee73c3fbd0
-
Filesize
5.9MB
MD5263b8a401528b440657bbdffc64c6487
SHA14e6eb74dc21503925645b3a8e4e8cfc63c6fb237
SHA2561227e484f32c34f026f311e60f1abae065e00f203153dbf0623152dedf5cafbd
SHA512c267ce96d420a2cd3d89023b7745b207851a9c2ad18f474cc8f4eedd40505b4fd7db347b04f5517eca3caee8974971ce478966a395ed412a9f7b4a7383710053
-
Filesize
2.5MB
MD5c5cac19a48b63987b767c8ce36a09282
SHA1899834cb9faa1a04029403085a761c5a2aae0045
SHA2569aec7890b56a86f175957b7a99fe57ce6234d16995e019d3008a5d599fdf8e28
SHA512a796cdec441c82353fc160d92af14ade268172b7d232c8f1bcdd5c807b7dce3c4c4cb877b467446b54f058b0bc4219f82ee99df2851d83d121ced2b3674ab1a5
-
Filesize
6.1MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
904KB
-
Filesize
728KB
-
Filesize
904KB