Analysis
-
max time kernel
112s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 03:35
Static task
static1
Behavioral task
behavioral1
Sample
541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe
Resource
win10v2004-20240802-en
General
-
Target
541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe
-
Size
5.9MB
-
MD5
d5cf63bd40ee7264411d869b1e0dedc0
-
SHA1
5ff886581eb6772a93a066b1c66916b58f2d0f8f
-
SHA256
541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04c
-
SHA512
97e5ec0dc6a598b675990b4c84e32438e4636fc204f1954d3fd188399c1a6404bf53c41d5061baa898be17ce76a26c3326251450c5be86726a939a87297bb86c
-
SSDEEP
98304:oKgKdd/yzt67OU7apwKgKdd/yzt67OU7apwKgKdd/yzt67OU7apv:0Cazg7DS8Cazg7DS8Cazg7DSv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe -
Executes dropped EXE 3 IoCs
pid Process 3812 7D57AD13E21.exe 2668 Scegli_nome_allegato.exe 2104 7D57AD13E21.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\7D57AD13E21.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3812 set thread context of 2104 3812 7D57AD13E21.exe 98 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Scegli_nome_allegato.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D57AD13E21.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D57AD13E21.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Scegli_nome_allegato.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Scegli_nome_allegato.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\IESettingSync Scegli_nome_allegato.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" Scegli_nome_allegato.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 4996 reg.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2668 Scegli_nome_allegato.exe 2668 Scegli_nome_allegato.exe 2668 Scegli_nome_allegato.exe 2104 7D57AD13E21.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1636 wrote to memory of 4996 1636 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 92 PID 1636 wrote to memory of 4996 1636 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 92 PID 1636 wrote to memory of 4996 1636 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 92 PID 1636 wrote to memory of 3812 1636 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 94 PID 1636 wrote to memory of 3812 1636 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 94 PID 1636 wrote to memory of 3812 1636 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 94 PID 1636 wrote to memory of 2668 1636 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 95 PID 1636 wrote to memory of 2668 1636 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 95 PID 1636 wrote to memory of 2668 1636 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 95 PID 3812 wrote to memory of 2104 3812 7D57AD13E21.exe 98 PID 3812 wrote to memory of 2104 3812 7D57AD13E21.exe 98 PID 3812 wrote to memory of 2104 3812 7D57AD13E21.exe 98 PID 3812 wrote to memory of 2104 3812 7D57AD13E21.exe 98 PID 3812 wrote to memory of 2104 3812 7D57AD13E21.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe"C:\Users\Admin\AppData\Local\Temp\541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe" /f2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4996
-
-
C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2104
-
-
-
C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2668
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5ec1d3c4e3bff6a3ea3a817dd02618f35
SHA10abe0e31efa4408e02f45ea22412e6bc40afc854
SHA2564973637d114f3e2632a610053db5f482a8185ef845aba44ee5cbd47e4eb45fcc
SHA51269a016b993c652c27689957df67c53f158241b8816a19a34d32b457f87950cc4bb39a9f6b6e2fc199bf1248158da61edde573285f2203c3c3396888fd6c3a17c
-
Filesize
1.0MB
MD5a2f259ceb892d3b0d1d121997c8927e3
SHA16e0a7239822b8d365d690a314f231286355f6cc6
SHA256ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420
SHA5125ae1b60390c94c9e79d3b500a55b775d82556e599963d533170b9f35ad5cfa2df1b7d24de1890acf8e1e2c356830396091d46632dbc6ee43a7d042d4facb5dad