a694421618ea485e198796361387f5a744ebdce9eb07216d1c38b081f05ef08e

General

Target

cde072bc388585bffec843021486f360N.exe
Size

558KB
MD5

cde072bc388585bffec843021486f360
SHA1

657048d74e1460b1977ec1d90768ef26fd6456b8
SHA256

a694421618ea485e198796361387f5a744ebdce9eb07216d1c38b081f05ef08e
SHA512

07b983cae93d66b062404d30a1310727577dd3a240e393c08f4f821360bbcc955aaeddf1018ae1035b936661c8d9016b927bc82f4d85e8ca05ca34c301f85077
SSDEEP

12288:21+vKnoA0cdoIl9jmDBJ4Uh2DEq/51r575O65n9VZ:e+vg0HU9EP4UheEq/B79R

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	cde072bc388585bffec843021486f360N.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.lnk	cde072bc388585bffec843021486f360N.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4892-0-0x0000000000400000-0x0000000000551000-memory.dmp	upx
behavioral2/files/0x000800000002360e-11.dat	upx
behavioral2/memory/4892-17-0x0000000000400000-0x0000000000551000-memory.dmp	upx
behavioral2/memory/4892-20-0x0000000000400000-0x0000000000551000-memory.dmp	upx
behavioral2/memory/4892-23-0x0000000000400000-0x0000000000551000-memory.dmp	upx
behavioral2/memory/4892-27-0x0000000000400000-0x0000000000551000-memory.dmp	upx
behavioral2/memory/4892-30-0x0000000000400000-0x0000000000551000-memory.dmp	upx
behavioral2/memory/4892-33-0x0000000000400000-0x0000000000551000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\360safo = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchcst.exe"	cde072bc388585bffec843021486f360N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cde072bc388585bffec843021486f360N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	cde072bc388585bffec843021486f360N.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4892	cde072bc388585bffec843021486f360N.exe
4892	cde072bc388585bffec843021486f360N.exe
4892	cde072bc388585bffec843021486f360N.exe
4892	cde072bc388585bffec843021486f360N.exe
4892	cde072bc388585bffec843021486f360N.exe
4892	cde072bc388585bffec843021486f360N.exe
4892	cde072bc388585bffec843021486f360N.exe
4892	cde072bc388585bffec843021486f360N.exe
4892	cde072bc388585bffec843021486f360N.exe
4892	cde072bc388585bffec843021486f360N.exe
4892	cde072bc388585bffec843021486f360N.exe
4892	cde072bc388585bffec843021486f360N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4892	cde072bc388585bffec843021486f360N.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4892	cde072bc388585bffec843021486f360N.exe
4892	cde072bc388585bffec843021486f360N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 540	4892	cde072bc388585bffec843021486f360N.exe	93
PID 4892 wrote to memory of 540	4892	cde072bc388585bffec843021486f360N.exe	93
PID 4892 wrote to memory of 540	4892	cde072bc388585bffec843021486f360N.exe	93
PID 4892 wrote to memory of 2912	4892	cde072bc388585bffec843021486f360N.exe	94
PID 4892 wrote to memory of 2912	4892	cde072bc388585bffec843021486f360N.exe	94
PID 4892 wrote to memory of 2912	4892	cde072bc388585bffec843021486f360N.exe	94

C:\Users\Admin\AppData\Local\Temp\cde072bc388585bffec843021486f360N.exe
"C:\Users\Admin\AppData\Local\Temp\cde072bc388585bffec843021486f360N.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:540
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=944,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:8
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini

Filesize
92B

MD5
2004bcee923b0e0222f4cab87c2c2a3d

SHA1
0a3c122b7cfe403403d913ecc1b328480b1bfc2a

SHA256
f92f08df2b65e2f5b5db141c99b098c8b077c0c853a1fd51bfcc6d40dc68ad77

SHA512
cae47a4dfdb942622ebca65d57e9d80c29cb299aa8c217983e34a51655c2e96ed26c7fa2fad978b6279ed4d3c8c0571e417c60152bf66a116f67d0fe38d6a445

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
722B

MD5
28751cd584f9da969241eed26aab1913

SHA1
93406acae51ef3126e7c18ed5e11c3576383a2d0

SHA256
6c17f2ce350ed11844b8462fb3ba7258f5bc5d2de987b5b9f0651fbbef5172b2

SHA512
305292cbe053f3a095f1bf2676bb8ddef2aef85c179278f77ce77e38c404003dd804205fcc38bc299545c24dc81dfe46fec5b70e21532de09b3129b40b581c96

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

Filesize
558KB

MD5
9b67b9598ef025c8fdf97fee3ac993e8

SHA1
f5cd785da8fd1fce26f959000211125308ed095b

SHA256
db3fa4139cc99545f7e8efc111ea2594c9938f17d40fbc5cc64be40c4927641d

SHA512
4edb4fc1dfa4c1d135f3e9115687729a1fe6cd9a5628cef264bd865b4985454c23802c6e3b27bb7a181956fe5637634e019f32c441d69b3cca002ecf7fe6d99f

Download Submit
memory/4892-0-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/4892-17-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/4892-20-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/4892-23-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/4892-27-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/4892-30-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/4892-33-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads