Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/08/2024, 15:18
General
-
Target
13d8638ffa2728a85f5a4477c1698230N.exe
-
Size
974KB
-
MD5
13d8638ffa2728a85f5a4477c1698230
-
SHA1
0f09305284619740d8f71592bb630085f99992fa
-
SHA256
6b4d1ddccb0760b0cbe5d392c9b0cc7d5a5eaa0be0772388e37c38a0aedb4f25
-
SHA512
8aa021c7cbde119c05b32e7a3b4b8dc2a408cbdb924ca790819c19eacfffd53b3422391b73977896a02b76a424a28104f23d3b2aa3dcf6956eff19905616cfaa
-
SSDEEP
12288:lOOZpUtlwX+zc7V5Rn1JyfPcOOZpUtlwX+zc7V5Rn1JyfP:nZhNrRCfP6ZhNrRCfP
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 4 IoCs
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 15 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\13d8638ffa2728a85f5a4477c1698230N.exe"C:\Users\Admin\AppData\Local\Temp\13d8638ffa2728a85f5a4477c1698230N.exe"1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\FCHSYHE.EXEC:\Windows\FCHSYHE.EXE2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
975KB
MD537bb1a2f5c78d8a00e759d3b764826e4
SHA146e1c3464bb2b001ebabb45116c1030f485668d0
SHA256585c0eea974a1d5f66c4592812438ed25038dd66a3047224b29f441c1f2f7cf7
SHA512c126274303fe6d2c6e8052137ab730eeaf9ce1de3950415d8caff702ed1ca96cb5b69b29cd9a2e2c20a4e0b4f685b17467ca4d667ac3474af4b146364f1b7b1d
-
Filesize
975KB
MD5d8e8ce7c166ff2b49025cf8f45c636b1
SHA171b6ef1acb5ebbb7194d725bd9070667e6152fe0
SHA256a4daa446d7eda78ba1aafbe6df2392ccc9e91df7c8a469317851d7691287d53c
SHA512fabc6b64ea9b8072ccaeb33caf84b0e829836757bca3dd127abd8fd3f202583e7fa6920fa6c3a53a4e3db7d4debe7e9ab0b39d28ea94c652320958fbd3659703
-
Filesize
231B
MD53402d424267d1ba7bb3f8defcc588d88
SHA1044ff4a4d1a6351c9a59e4397ab8d9c08722cf78
SHA2560916e6dfe94e2f96c3c3dfcd4ca9bc827f428f7bb29735a2f2f7b873c180593e
SHA5129755d87aa626c021dbe526b4d18a52f26491b2b791959f9feb3be2e17f049f1080d42b278c58ad71f47715bc8b1aaf7608dc866a7b9d89c7da90410873e04634
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
4KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
4KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
4KB
-
Filesize
448KB