8e134c44c8708784137b6fcd4897101e54359cf9ba87fa4781c11e6772ffdfc7

General

Target

7a00a65b9bc3ef2ac4ad3733b2479fd0N.exe
Size

5KB
MD5

7a00a65b9bc3ef2ac4ad3733b2479fd0
SHA1

6604a90017ae96b5a8a24e91f5a82ab40ac54585
SHA256

8e134c44c8708784137b6fcd4897101e54359cf9ba87fa4781c11e6772ffdfc7
SHA512

9ec37972a69256abd09aef7eb32da05a3d80eecccfa5c88c7acef4387256652dc7fca7f998b568f8aac76b3e73b966deb7531b71a285543731eb4a065172ceff
SSDEEP

96:/EGp1qQRQmgGhlfZT8kYlXsBIArL4zNt:/tmoQmfhf8kYJsyYa

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	7a00a65b9bc3ef2ac4ad3733b2479fd0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2288	timeout.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3144	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3144	explorer.exe
3144	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 2176	4508	7a00a65b9bc3ef2ac4ad3733b2479fd0N.exe	85
PID 4508 wrote to memory of 2176	4508	7a00a65b9bc3ef2ac4ad3733b2479fd0N.exe	85
PID 2176 wrote to memory of 2288	2176	cmd.exe	87
PID 2176 wrote to memory of 2288	2176	cmd.exe	87
PID 2176 wrote to memory of 2740	2176	cmd.exe	92
PID 2176 wrote to memory of 2740	2176	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\7a00a65b9bc3ef2ac4ad3733b2479fd0N.exe
"C:\Users\Admin\AppData\Local\Temp\7a00a65b9bc3ef2ac4ad3733b2479fd0N.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ImECbX8D.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\system32\timeout.exe
    timeout /t 3
    3⤵
    - Delays execution with timeout.exe
    PID:2288
- - C:\Windows\explorer.exe
    explorer /select,""C:\Users\Admin\Desktop\viso_mdm.zip"
    3⤵
    PID:2740

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ImECbX8D.bat

Filesize
230B

MD5
9e1508066c979dd24566d5b203afb04d

SHA1
2eb6f0a47bb0432126c90f5b9519241e23f9206e

SHA256
78b4bf63fbca504d482739dbbb397e93889e4682751197655d48e2b5863ad0d5

SHA512
1fac2c64934a096e1a3365bd046138eccda151ba4c9064d1c0e456af71df0c3f3d7231b35f03b5300cfc2f5185c2ef438c5290372fe1b05a65225ca20d311e98

Download Submit
memory/3144-8-0x0000000002F50000-0x00000000030FE000-memory.dmp

Filesize
1.7MB

Download
memory/3144-20-0x0000000002F50000-0x00000000030FE000-memory.dmp

Filesize
1.7MB

Download
memory/4508-1-0x00007FFA7B6A3000-0x00007FFA7B6A5000-memory.dmp

Filesize
8KB

Download
memory/4508-0-0x0000000000350000-0x0000000000358000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing