Analysis

  • max time kernel
    134s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 09:35

General

  • Target

    $_3_.exe

  • Size

    1.8MB

  • MD5

    77bfacca17ee1d89833b57f3a746d9a0

  • SHA1

    aa9490c913489c5eafd02f67f875efcb56d23036

  • SHA256

    38571b0965110d07c6fbf4813ab628d4017cf52c681c457fb3f184b644fb0b52

  • SHA512

    21ecc2fce94a58cd39127964730b01722b9dafa20d3af65b023fe83188c08211ba1324849513ffc10b6a359737f98c4d06770dc1954f8880daff938a06581e6f

  • SSDEEP

    49152:/SNY8H0ZGF5j51XdQTPRPgojx1NslvUOl/WkMWAH:oY00Z8F1XdUL

Score
5/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$_3_.exe
    "C:\Users\Admin\AppData\Local\Temp\$_3_.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3648
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\11104.bat" "C:\Users\Admin\AppData\Local\Temp\6B72DFDC7AFF47FB929B76C6203EE359\""
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2876
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4440,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
    1⤵
      PID:4548

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\11104.bat

      Filesize

      214B

      MD5

      739fcc7ba42b209fe44bea47e7a8c48f

      SHA1

      bc7a448a7c018133edcf012bc94301623eb42c5b

      SHA256

      69017cdbbe68396f45e41d211b22d800cc1afc0eadbd3440873038585020315c

      SHA512

      2b2b130798b0f4e534626b9fb5deaa10bb1930e6700ac0ba7cf151c1bf3239039a7032ea67ceed86a4a4dbe981064c42a8e0f88fe8361e27002dd8ceb0ea767a

    • C:\Users\Admin\AppData\Local\Temp\6B72DFDC7AFF47FB929B76C6203EE359\6B72DFDC7AFF47FB929B76C6203EE359_LogFile.txt

      Filesize

      9KB

      MD5

      a987b94b705ae3c010b72e13cf33ef92

      SHA1

      d0d833b418a3d4f7c31e2bf82390532b4c867e13

      SHA256

      b69f22a3758b3e7d07a9a9f4509e1446242247225fc0ca8c6d646920bced0c6a

      SHA512

      cd71eece0f6abf00fd5801d1dd162ef757cb2fbf3aee1f1a57e3f3910cc59774c4eb9a526a4e22d6b82b282f6522529e7e50ae6966f3bd81e722fa51b6bf66f6

    • C:\Users\Admin\AppData\Local\Temp\6B72DFDC7AFF47FB929B76C6203EE359\6B72DF~1.TXT

      Filesize

      124KB

      MD5

      edd0c0c692a4b46006e1fb1c167d571a

      SHA1

      29f6c045b1299c775e9385394f1689073393265d

      SHA256

      8c6a6915fe9766b07cfe223a5c0555ed51b6932b3cf3f63aedc9218158d56e0d

      SHA512

      4f5a4d057c7e6560297a81dccbabcab8cf34627bfbc1963f613796ab0695ff9836af6b1f22dfc06eb125edf8db11efa4d0e08fa54943fcba462837bdc543f481