Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
24-09-2024 01:04
General
-
Target
136e03127b12cc2b5242530339b24ad7c082741c152783d996b3fa63bc21f6de.exe
-
Size
522KB
-
MD5
06a0c92c691e980875b3345ce72fe78b
-
SHA1
ab38c20a9e04f0ffe951a194075c296373e3e367
-
SHA256
136e03127b12cc2b5242530339b24ad7c082741c152783d996b3fa63bc21f6de
-
SHA512
ea60783778989f0979e6edc25b4877d073ac7ea0a067fd7750a679eb6f380212e739ef07d6239911a4a3604e236ccdf65df6fd9faccd37f2c25116844e91f2cb
-
SSDEEP
12288:JzxzTDWikLSb4NS7QX+tjUXZkzF4Lyqe185h9pp3bQ/FO:zDWHSb4NkJ4S6hE/s
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\136e03127b12cc2b5242530339b24ad7c082741c152783d996b3fa63bc21f6de.exe"C:\Users\Admin\AppData\Local\Temp\136e03127b12cc2b5242530339b24ad7c082741c152783d996b3fa63bc21f6de.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\windows\temp\i0C.exe"C:\windows\temp\i0C.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\windows\temp\3950.docx" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
30KB
MD5daadd19803a76add7d5d0d707172c1d1
SHA1c9d71423fca459786073a6bdfa48f4a1636335ad
SHA25679c64517400d205f149825cb196576cdf9a2ce7d41b554d5065de0ec71ef1c29
SHA512ce567bacb900ed86f89c987020781bd3cb6e9cfc78d346e508d81c3d17ae9526ea89f7ce6f8c532211e36116397ea15ac9dcb91131f58e12a2c3df12a5acffa6
-
Filesize
650KB
MD598ce25fcd5b58bf3a90ba1b4c306cbc1
SHA193f89bf4754809702df814db2be8f2d905128402
SHA256b3174a40b59341a5604ac5878c80ec7033f223c4122ff407c1c61a5231dea84e
SHA51201ca4d9bfd35944f8888713a296f857e9b7c7f72a4f1883cd56089b728c2056576e7e48dfd877b506653054beeee9a0982b48d4718dd7fac3f8830e9a26615c8
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
628KB