Analysis
-
max time kernel
119s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22-08-2024 19:13
General
-
Target
bc3e5f392e460a69e7c116f9578e9230N.exe
-
Size
50KB
-
MD5
bc3e5f392e460a69e7c116f9578e9230
-
SHA1
c916c7bde6d6cc8d790478ea585b12dc94693a5e
-
SHA256
6e2c3c3a160a9763e6415653302fe3b7c5d7b7984d3ffbdaf961457a694584c6
-
SHA512
2d3c523c3119d9f26a3a5ba934bdbc82628fb41e0dc20bfe010bf9c7cbf7ad4a633966236dc754de22bdb02423f13b8325b79a450c41f66a3b36771e1c9b6dec
-
SSDEEP
1536:onGPLT11CfUQv+xhWylmBaqFsJC5F5BzXUnwzjx/u1bmtlokMfGXf:FPLBYU+qhwFD
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc3e5f392e460a69e7c116f9578e9230N.exe"C:\Users\Admin\AppData\Local\Temp\bc3e5f392e460a69e7c116f9578e9230N.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD5e99147365dd100826ccf99255176011a
SHA1ff1edc84aa192743d51b8e08a3492c36a2c7c35c
SHA25616cf5f73efb508e4fd4402b910017dbfdd0336583afec1cd11aac3b32ad0ad2c
SHA512bc4cb995e002e3620d7a098c2c73d88f71aebbff3a22f895b90a8c0a892c638c00ddda1c0f8818dc44d9573845c7892afaeb3918c281bf01e17148ce5fdefe9e
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB