60e6412fdb3579181ab9b9473e25e53d58008f45476b0536c04b52a940238b7f

Analysis

max time kernel
80s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60e6412fdb3579181ab9b9473e25e53d58008f45476b0536c04b52a940238b7fN.exe
Size

320KB
MD5

f178f33904604e817be3d4504a8a8530
SHA1

2a55516125be7ee608bd40f91eea1a2524c35366
SHA256

60e6412fdb3579181ab9b9473e25e53d58008f45476b0536c04b52a940238b7f
SHA512

f09c652ec9346079a3b8e3e92df82028676a987bd849f5d9e1cb560aaef9cb1c769d707879e561f70720151aa878a90de7d2b639d34b75074a2bb1978cec0107
SSDEEP

6144:FXkmZOBRtoITkA53pK122OWXHCmHZW50l7F9R6ew+5:hOBRtMcow2OWXH5HZW5qHRX5

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	60e6412fdb3579181ab9b9473e25e53d58008f45476b0536c04b52a940238b7fN.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	daida.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	60e6412fdb3579181ab9b9473e25e53d58008f45476b0536c04b52a940238b7fN.exe

Executes dropped EXE 1 IoCs

pid	Process
3508	daida.exe

Adds Run key to start application 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /x"	60e6412fdb3579181ab9b9473e25e53d58008f45476b0536c04b52a940238b7fN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /t"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /w"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /t"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /g"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /r"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /e"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /o"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /f"	60e6412fdb3579181ab9b9473e25e53d58008f45476b0536c04b52a940238b7fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /i"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /o"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /g"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /u"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /u"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /q"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /k"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /v"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /n"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /b"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /h"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /b"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /s"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /r"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /z"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /v"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /n"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /c"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /m"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /a"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /l"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /x"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /s"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /d"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /p"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /i"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /j"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /h"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /q"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /y"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /f"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /p"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /w"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /m"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /e"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /j"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /l"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /z"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /x"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /k"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /f"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /c"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /y"	daida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /a"	daida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daida = "C:\\Users\\Admin\\daida.exe /d"	daida.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60e6412fdb3579181ab9b9473e25e53d58008f45476b0536c04b52a940238b7fN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daida.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3232	60e6412fdb3579181ab9b9473e25e53d58008f45476b0536c04b52a940238b7fN.exe
3232	60e6412fdb3579181ab9b9473e25e53d58008f45476b0536c04b52a940238b7fN.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe
3508	daida.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3232	60e6412fdb3579181ab9b9473e25e53d58008f45476b0536c04b52a940238b7fN.exe
3508	daida.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 3508	3232	60e6412fdb3579181ab9b9473e25e53d58008f45476b0536c04b52a940238b7fN.exe	93
PID 3232 wrote to memory of 3508	3232	60e6412fdb3579181ab9b9473e25e53d58008f45476b0536c04b52a940238b7fN.exe	93
PID 3232 wrote to memory of 3508	3232	60e6412fdb3579181ab9b9473e25e53d58008f45476b0536c04b52a940238b7fN.exe	93

C:\Users\Admin\AppData\Local\Temp\60e6412fdb3579181ab9b9473e25e53d58008f45476b0536c04b52a940238b7fN.exe
"C:\Users\Admin\AppData\Local\Temp\60e6412fdb3579181ab9b9473e25e53d58008f45476b0536c04b52a940238b7fN.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Users\Admin\daida.exe
  "C:\Users\Admin\daida.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4464,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:8
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\daida.exe

Filesize
320KB

MD5
cdbde4176a68ed60f1f7855d5079d53e

SHA1
332f688655ea22207aba24f4b92847d858c812b9

SHA256
b57360bd118ca150ef7d3519a8ee974d65f07cafec3ca7c0598e632d0e38bd67

SHA512
453fb304568096df2daaf384d448e1e23eb78bb49797d262bb68583983d1c7f4adccf345ede2877ea26d4deb8907df5c83b7bf6842a0abd3c54f025510b8a646

Download Submit
memory/3232-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3232-37-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3508-33-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3508-38-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download