Analysis
-
max time kernel
111s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
28-09-2024 20:02
General
-
Target
f860040b23f5087b90d364e20926219479ff3cf63fff6d21a05dcdf1a2752fbbN.exe
-
Size
820KB
-
MD5
2f629ee1ae60e54bf73c7de3699d5ec0
-
SHA1
4dfc6ed6fabde0ad7b0151e5d89e64c35e92fbbf
-
SHA256
f860040b23f5087b90d364e20926219479ff3cf63fff6d21a05dcdf1a2752fbb
-
SHA512
0d472f14f2c6bf1a449bd327323645378b1eba352375bf09e53c0141bf9c613a1b65947bb3219b9cdecfe113eccfc9abbaf4fdda4bab648f2f6b226b6e87437c
-
SSDEEP
12288:UMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9N3Z:UnsJ39LyjbJkQFMhmC+6GD9T
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f860040b23f5087b90d364e20926219479ff3cf63fff6d21a05dcdf1a2752fbbN.exe"C:\Users\Admin\AppData\Local\Temp\f860040b23f5087b90d364e20926219479ff3cf63fff6d21a05dcdf1a2752fbbN.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
820KB
MD52f629ee1ae60e54bf73c7de3699d5ec0
SHA14dfc6ed6fabde0ad7b0151e5d89e64c35e92fbbf
SHA256f860040b23f5087b90d364e20926219479ff3cf63fff6d21a05dcdf1a2752fbb
SHA5120d472f14f2c6bf1a449bd327323645378b1eba352375bf09e53c0141bf9c613a1b65947bb3219b9cdecfe113eccfc9abbaf4fdda4bab648f2f6b226b6e87437c
-
Filesize
23KB
MD591d0d9da357de5320e01b8d2c74ff752
SHA1b56a1e3e253993c13fb5d08d12e3b99a3182261b
SHA2564036f5e653dd6676effa8af7824a9bcb5359c9014d48e7bdeb54905c517f3992
SHA51210c74f9e2d9ee951cb35a6519933b8fbbca28bdf8a8750bfa7e5cc6085c021e24121e5515607d20714770724f7a92757234d20d6b9d724bf39ad4625ba2d1fad
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
4KB
-
Filesize
844KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
844KB
-
Filesize
844KB