Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03/09/2024, 00:11
General
-
Target
6690204ed0041210274e149fd7aa719b242cbc25a046bf5274c26bfb0c7feb47.exe
-
Size
33KB
-
MD5
f8c828f938d4ed21c3c0d69a1c9211e4
-
SHA1
198636a32191acc85071a8ef4ad77dbd2f08c3da
-
SHA256
6690204ed0041210274e149fd7aa719b242cbc25a046bf5274c26bfb0c7feb47
-
SHA512
82f546ad372f6c093bd4881435f79a368320a2e6952fbbad83f69c0d193df79418a2464198db2aaebd036c681944ea01139aa27e9698ee61dee337039c09c5f4
-
SSDEEP
768:UEzNbLcQ9qQuVriDMuyuruTD0qB77777J77c77c77c7nOT1g:l3h9qQA6hZunrB77777J77c77c77c7O+
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 25 IoCs
-
UPX packed file 31 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 5 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 26 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 11 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 34 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6690204ed0041210274e149fd7aa719b242cbc25a046bf5274c26bfb0c7feb47.exe"C:\Users\Admin\AppData\Local\Temp\6690204ed0041210274e149fd7aa719b242cbc25a046bf5274c26bfb0c7feb47.exe"1⤵
- Modifies WinLogon for persistence
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\÷ùúØÒøÌø÷„•.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\÷ùúØÒøÌø÷„•.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\üþÿÝ×ýÑýü.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\üþÿÝ×ýÑýü.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\üþÿÝ×ýÑýü.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\üþÿÝ×ýÑýü.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\the [K]angen is back.doc" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\÷ùúØÒøÌø÷„•.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\÷ùúØÒøÌø÷„•.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\üþÿÝ×ýÑýü.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\üþÿÝ×ýÑýü.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\÷ùúØÒøÌø÷„•.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\÷ùúØÒøÌø÷„•.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\÷ùúØÒøÌø÷„•.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\÷ùúØÒøÌø÷„•.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\üþÿÝ×ýÑýü.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\üþÿÝ×ýÑýü.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\the [K]angen is back.doc" /o ""6⤵
-
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\üþÿÝ×ýÑýü.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\üþÿÝ×ýÑýü.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\÷ùúØÒøÌø÷„•.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\÷ùúØÒøÌø÷„•.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\the [K]angen is back.doc" /o ""7⤵
-
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\÷ùúØÒøÌø÷„•.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\÷ùúØÒøÌø÷„•.exe7⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\üþÿÝ×ýÑýü.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\üþÿÝ×ýÑýü.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\the [K]angen is back.doc" /o ""8⤵
-
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\üþÿÝ×ýÑýü.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\üþÿÝ×ýÑýü.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\÷ùúØÒøÌø÷„•.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\÷ùúØÒøÌø÷„•.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\the [K]angen is back.doc" /o ""9⤵
-
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\÷ùúØÒøÌø÷„•.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\÷ùúØÒøÌø÷„•.exe9⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\üþÿÝ×ýÑýü.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\üþÿÝ×ýÑýü.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\÷ùúØÒøÌø÷„•.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\÷ùúØÒøÌø÷„•.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\the [K]angen is back.doc" /o ""11⤵
-
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\÷ùúØÒøÌø÷„•.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\÷ùúØÒøÌø÷„•.exe11⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\üþÿÝ×ýÑýü.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\üþÿÝ×ýÑýü.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\÷ùúØÒøÌø÷„•.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\÷ùúØÒøÌø÷„•.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\the [K]angen is back.doc" /o ""13⤵
-
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\÷ùúØÒøÌø÷„•.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\÷ùúØÒøÌø÷„•.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\the [K]angen is back.doc" /o ""12⤵
-
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\üþÿÝ×ýÑýü.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\üþÿÝ×ýÑýü.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\the [K]angen is back.doc" /o ""10⤵
-
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\üþÿÝ×ýÑýü.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\üþÿÝ×ýÑýü.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\the [K]angen is back.doc" /o ""5⤵
-
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\÷ùúØÒøÌø÷„•.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\÷ùúØÒøÌø÷„•.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\the [K]angen is back.doc" /o ""4⤵
-
-
C:\Windows\SysWOW64\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}\üþÿÝ×ýÑýü.exeC:\Windows\system32\printer.{2227A280-3AEA-1069-A2DE-08002B30309D}.\üþÿÝ×ýÑýü.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
413B
MD59b95183821471fb6255136a647d08fb8
SHA1b078f64ad6009e2c59afe504351fd11191f16666
SHA25661091066a3c572755212663e6a03eeebef6a3c12d338af21a68c208806880882
SHA512212cccacd42cd403d5d0547caa0aab7a66d49195a61aa8a1a6bbc6ed8c3f4af7c920aed4b41ed8d6eeb77792f5467617bbc517d0a782d7e67d537a35cedf246b
-
Filesize
413B
MD5803f360723a357add605ce9038a4e1bc
SHA1c56e1028b031ad3df3f989d9fc0031d1f8ca74ff
SHA256a59938d8fe5dac3af5d88af11e0cd6431687804788b0c97dda53e5b444c98626
SHA51216937e46f9e56c3007c38b7554098fd92509d3a7ca40b889b6ab50407ea5c5b2fce7645d327582ffa9866011552b2554d0848c67ce1fbfa3d16556edd3723487
-
Filesize
377B
MD50d6dc7bb6e9e97ef40655c91295b0322
SHA1369f43a3b498d796952e0ef431d7d07645d916c2
SHA2565ba8387b2f0038aa3b5a42c6ac7fff4a7033891df1f0e300c5e0c2796fbc8a7f
SHA5122199c136306ff3218c04623856d27b1c511201172dc594f120cafebd3a2adf74c12ee7e886bbf2f5b7499433336d43c7ba0a3c0882041af3f4142f531c353c40
-
Filesize
1KB
MD5cf2764982fa8ab78eb4d8d96afe33ea4
SHA1ec78fb3c58bf3bda958a16a0a35e5c4b2d6eec90
SHA2563a778771171ba350af4eb2039bcc4ade74246f06837430b31d5fed0dd4e7c1e3
SHA512f6278346b169b4444aebf6d49fdb52cadb1fdc830cc4642f0862c15d5a6f58285c8c4bca877ca717bb000cc9bb86632246cb2f85f4c1091ce4d86d5e7b3d8467
-
Filesize
16B
MD5d29962abc88624befc0135579ae485ec
SHA1e40a6458296ec6a2427bcb280572d023a9862b31
SHA256a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
SHA5124311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
-
Filesize
6KB
MD5730ce61abbb36e76c9e06a2b7e5212a7
SHA17436058ca37a58f15d1665796223e2e4aecaca1c
SHA256805b903c4557f4abea0640d516b28612d0f61ff4069eeb2bc7799ff9580008fb
SHA512c3d63bbd7c8b259ea904648942c729e2812e4127c6d680b4d515d20dfb3740f0e111ecb8db7815b51c454814d34cfb006784ee89e567681af23e98acacb12c04
-
Filesize
63KB
MD5e548f7ae8264b8a33db00e77cf5871a0
SHA18293bb85e2a1cd33a334d30d61c2fe6a6ebb7708
SHA2561ff8313a2087fd8f3ed535f828a9d8a90f237a75cb37e4462635bd1d84e8e715
SHA51288ac532acd3411d3c1e4a84a9fbb77a9ceb71a410abbf38b20caef433b42760dd47a513b229c8a3cb4f73079ad979d6fd9a9ebcd2ebaf82987540d7e5d16605d
-
Filesize
38KB
MD5aba8c6e0b3d33c1d76ad3f68c066911e
SHA1564b3684776a8fa9b544ac1514a177f785d73dce
SHA256d07f2a8f53f24176fc510325b3789587982c7407fd39de68c2d8735eae3ecc6d
SHA51278c26fc100ff6af039311d7aff217d3d6a15d6a84902dbacde1228bb6cedb84d9ed0b7f814bb177c78eab063684e7010c416c282f30cc2d3c0f4c6a137e1ad74
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB