Overview

overview

7

Static

static

3

8afd7be075...0N.exe

windows7-x64

7

8afd7be075...0N.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/09/2024, 00:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    8afd7be075696bed21450752b3e95710N.exe

  • Size

    1.0MB

  • MD5

    8afd7be075696bed21450752b3e95710

  • SHA1

    adb7489154926af72e60d80656b0c6c9354725a2

  • SHA256

    505df41d864e25e90175013bd19f6debc1650fff8580e4b9493f6fa3f7ce2840

  • SHA512

    9d5dfc508e23ae5634025860ef8076c0ba77513097a8b599933cde1d01d8abb3977d8ca83f8490b1e1cd538d5a2f051b74e93b70b4ae0095e4a38d7eb6554bf9

  • SSDEEP

    12288:rjfoMXG5cpFKksKwPsVY3Ymfp2GJwJSHB8GM0T4TD+Yks/0g3yfd3k94g4V:rjuy2dsUZJO8B8pD+Yb/M3Eb4

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8afd7be075696bed21450752b3e95710N.exe
    "C:\Users\Admin\AppData\Local\Temp\8afd7be075696bed21450752b3e95710N.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:388
    • C:\Users\Admin\AppData\Local\Temp\8afd7be075696bed21450752b3e95710n.exe
      "C:\Users\Admin\AppData\Local\Temp\8afd7be075696bed21450752b3e95710n.exe" C:\Users\Admin\AppData\Local\Temp\8afd7be075696bed21450752b3e95710N.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3952
    • C:\Program Files (x86)\Adobe\acrotray.exe
      "C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\8afd7be075696bed21450752b3e95710N.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5112
      • C:\Program Files (x86)\Adobe\acrotray.exe
        "C:\Program Files (x86)\Adobe\acrotray.exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\8afd7be075696bed21450752b3e95710N.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4660
      • C:\Program Files (x86)\Adobe\acrotray .exe
        "C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\8afd7be075696bed21450752b3e95710N.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3640
        • C:\Program Files (x86)\Adobe\acrotray .exe
          "C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\8afd7be075696bed21450752b3e95710N.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2932
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3480
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3540
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3540 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2572
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3540 CREDAT:17416 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2316
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3540 CREDAT:17424 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3204

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Adobe\acrotray .exe
          Filesize

          1.0MB

          MD5

          1f94373078c10b3f0b4bab648985fbec

          SHA1

          b6cdf803445aa037ae269a9d2a77717debe5576d

          SHA256

          242032207514dce1bb49a9d25ec59a5ecd0454c367a381a8ca433557cfe94ba0

          SHA512

          c476846e9a924eec038a0a5c0f2b907d25c82c6e04317ecd730972183c814459247a09334c59bdb1520c8040392a9e815dbcf396e3ee08ba22ca00e4a7246b72

          Download Submit

        • C:\Program Files (x86)\Adobe\acrotray.exe
          Filesize

          1.1MB

          MD5

          0055553b8d3cb113e98bf6346b5e561a

          SHA1

          352a9726a4040a77cc032010997063d04f168039

          SHA256

          1890b8e9e123251bfc8d50d99222e7e59e4639bd92a4a00c9c6d798d648f6610

          SHA512

          c580337e59d002ace81111b591b0d4fe4acbf49208aca89e47084efe7c3b31f83fe17321d89c2a2921f28d3fd6324b1cef63dccfbf76959ffb4ea5b00f49b631

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TBBQW6D\byAMMuAJU[1].js
          Filesize

          33KB

          MD5

          e2ec36d427fa4a992d76c0ee5e8dfd4d

          SHA1

          47ec4ace4851c6c3a4fe23ad2c842885f6d973f2

          SHA256

          36488e81afcbc4d7018b8764c18032b10be21aa45521c9671fde0cc77f70b2d8

          SHA512

          d1ae29d19f65ce74b9b480c82b87315634ec2e96d199f5feb423918af9ad6e24c8b436e03904d452f71562f04c42acbb250256eed73bcd592a79c08911c74976

          Download Submit

        • memory/388-0-0x0000000010000000-0x0000000010010000-memory.dmp

          Filesize

          64KB

          Download