Overview

overview

7

Static

static

3

1b901588f2...01.exe

windows7-x64

7

1b901588f2...01.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    92s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/09/2024, 19:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    1b901588f2a677e36241ec021fe2c6f932279f41ebb58856d47ffa393dbef601.exe

  • Size

    92KB

  • MD5

    f4be08068c4a95969310d0ee27f3ee8c

  • SHA1

    46f2606b6b84ba5f22af7c0eadc809c502144669

  • SHA256

    1b901588f2a677e36241ec021fe2c6f932279f41ebb58856d47ffa393dbef601

  • SHA512

    9db7aa60dfed027b150dde92235892a8e1f77f97c0840e5ad7e8edd340a030e87b3c18702a53b88dfd2d12a68ef632f99367426df1203c5d202e5b42897c6ec0

  • SSDEEP

    768:AiNeDLfC/mwcJhfCL8aC9R1KVboVsCOuS2GsjOStmoJC6KXIwKmpk55a0B8yGgIr:Ai4Jbxb2pk5wW+ZYzu

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 57 IoCs
    adwarespyware
  • Modifies registry class 29 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b901588f2a677e36241ec021fe2c6f932279f41ebb58856d47ffa393dbef601.exe
    "C:\Users\Admin\AppData\Local\Temp\1b901588f2a677e36241ec021fe2c6f932279f41ebb58856d47ffa393dbef601.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5084
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c regedit /s c:\reg.reg
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4792
      • C:\Windows\SysWOW64\regedit.exe
        regedit /s c:\reg.reg
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:2516
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.520921.com/?1
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4688
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4688 CREDAT:17410 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:920
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c regedit /s c:\reg2.reg
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1272
      • C:\Windows\SysWOW64\regedit.exe
        regedit /s c:\reg2.reg
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:2804
    • \??\c:\windows\SysWOW64\wscript.exe
      c:\windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\Killme.vbs
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:4892

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          Filesize

          471B

          MD5

          bf94c1f95b86846942364d11a17851b4

          SHA1

          63700cc94ae31ecd3bb028332dcdf9a0964ed406

          SHA256

          66481be25e3d5754ba4c58aa4cceab5cf66f4c82b3bb45d82d6980822efb075d

          SHA512

          e7a4f19100de4abf24c3cc89e913ca1f5d81b64b6bcad8a377a4d540e45f65b805aafc0ab78c5c2ce7b6b02ad51393272d20996c5d188e4ceabc40c4b9a310cf

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          Filesize

          404B

          MD5

          eb9575ce4c5cb204ec9e57b14e93c309

          SHA1

          03d98e89420bccadd9c547c50c435e1617e87763

          SHA256

          7a378fdeb9788f502ad223de6783d1d8bbb751406f4a46fe25c8d3506b5ee1dc

          SHA512

          b00c7d25315416e762c46d2dd6289f3962f36a5ee31d53ce23df18a1c90e98f9ca984aef661d9924366350caca23f343411c88baeb2ba6473ae2dd8feeef73ac

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver265F.tmp
          Filesize

          15KB

          MD5

          1a545d0052b581fbb2ab4c52133846bc

          SHA1

          62f3266a9b9925cd6d98658b92adec673cbe3dd3

          SHA256

          557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

          SHA512

          bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3HDB1LPD\suggestions[1].en-US
          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Killme.vbs
          Filesize

          307B

          MD5

          e1087903f490ee4bf4c7461716325ca7

          SHA1

          017645220da9abde5a27a5137d7ccde532ccc93b

          SHA256

          90e4a46befe4f3f233a47d234feeb2cbac8e290ff829cb2e8b49efae0c32e5e4

          SHA512

          d2be9be0ac4da40bd60319a839c1660ac0bfc72c193fe113653b89741171ad328286f1ae8b55902b00a607b4b4ae4765301ba15fb02844413f530c678eebefc6

          Download Submit

        • \??\c:\reg.reg
          Filesize

          195B

          MD5

          d074af1950aed38a9507428f23df9ad2

          SHA1

          0313b03e880b283cfacf64aea25c54259d388201

          SHA256

          5f3cd51950de3b9c7f8bb8a14cf5c39f3d480270d89a7c8fabb54900c9c34ca8

          SHA512

          484029eb461a182a9b088f9912047d455749381eab696d15af719f020f4982b6a331b20f1ab5437a8f9312724770ac26791f83d20c79e0e1b1340e53d1122fbc

          Download Submit

        • \??\c:\reg2.reg
          Filesize

          450B

          MD5

          2944837920fafc0892eb196e7d774b23

          SHA1

          31269a61616a0064576e0e6a93e23722cf5a2057

          SHA256

          1c2c0c933e0023e7a24cdd4dd5bf363b00449094d3dc9ff3e7188d893e2580dc

          SHA512

          027b5677254eb8582a672cee88cd5c82dce09170fdc2fd47e9dfaacbd29b691719a5c7ecacbae1fb8c3a5d4a5243e9d3aad64be63e9c788e01f6dfd24f0e003f

          Download Submit