b27b31d0ace71e743e05e7fc14d66fe0884c5dc4f9312d91b9346c05fd0a9ee7

Analysis

max time kernel
35s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ThunderKitty-Built.sfx.exe
Size

3.9MB
MD5

02b1176cf08691be00f90181f6627324
SHA1

630161e9332a8ab8e4d8e96091f0d1427faa44c6
SHA256

b27b31d0ace71e743e05e7fc14d66fe0884c5dc4f9312d91b9346c05fd0a9ee7
SHA512

4c4ee6c1c044b964d807676ed30608cbba5c4f92218ca12e4a03d16b8b67948728ce995e398cfc913cfc21063945af5c902b64f6f244763a7b08cd1e268bad7a
SSDEEP

98304:0qwCxfzSG0PsDj1WG3zx7aDo8DZOyo1TGO:0qwCpWGsKj1x3zxeh9IX

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	ThunderKitty-Built.sfx.exe

Executes dropped EXE 1 IoCs

pid	Process
2220	ThunderKitty-Built.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
60	reg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 2220	3368	ThunderKitty-Built.sfx.exe	84
PID 3368 wrote to memory of 2220	3368	ThunderKitty-Built.sfx.exe	84
PID 2220 wrote to memory of 60	2220	ThunderKitty-Built.exe	86
PID 2220 wrote to memory of 60	2220	ThunderKitty-Built.exe	86

C:\Users\Admin\AppData\Local\Temp\ThunderKitty-Built.sfx.exe
"C:\Users\Admin\AppData\Local\Temp\ThunderKitty-Built.sfx.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\ThunderKitty-Built.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ThunderKitty-Built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\ControlSet001\Enum\USBSTOR
    3⤵
    - Modifies registry key
    PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ThunderKitty-Built.exe

Filesize
9.8MB

MD5
2adb55dd2dbb6f50de78f19d158a1302

SHA1
88d59831897c608da2317c70e412124dc93d12eb

SHA256
cb70b5efc101cc7446faa510535b759dd3d31d6a18ac343bf36827111373767b

SHA512
2b4a7c90bba4f87aa646ae7a2809862bbd901afe34cd97a90f49805a6ab7be02b1f6f6cdef25ed89bd1b8007a6782e2d259e37156c1fcf651fd544019d37425f

Download Submit