Analysis

  • max time kernel
    120s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-08-2024 03:23

General

  • Target

    5027a3951c3f91cf79bca75a270d88c0N.exe

  • Size

    53KB

  • MD5

    5027a3951c3f91cf79bca75a270d88c0

  • SHA1

    9e28acae31a02840deea4f4e8af7bbd2990ea17b

  • SHA256

    ed4df7ca8c133bb97223660e3c5b92dcfd7a44253347f315add4ab833b22b8f5

  • SHA512

    a47bcd3338fa3f8580a556e3e49fe13fd50037daceffcb3efd99676e2ea546f810bc65b9ad39be4b62bc200460bcb2c9a123f8dc0776bc62b5c214809fc33266

  • SSDEEP

    1536:HNewg8r8QBPM1wu7Kp3StjEMjmLM3ztDJWZsXy4JzxPMk:rPM1hJJjmLM3zRJWZsXy4JN

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5027a3951c3f91cf79bca75a270d88c0N.exe
    "C:\Users\Admin\AppData\Local\Temp\5027a3951c3f91cf79bca75a270d88c0N.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1540
    • C:\Users\Admin\jwlieq.exe
      "C:\Users\Admin\jwlieq.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\jwlieq.exe

    Filesize

    53KB

    MD5

    289bae4f2fc5ba0df4b58bd05ac574a1

    SHA1

    a228f303722cb513fa248cde2dc6e2835e0c8467

    SHA256

    da144fc2af1abfa363888e598e2c09e1a94120ccfe29d099f612ca295a7b8bbb

    SHA512

    e2358049b3f3690891a87e4fc869e870d6abd196ebd21d7dc1cca3807b8511152eab5e4823495edc9f932f71f288315304dcdaf75df62d6854f79aaf10e99c85