Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-10-2024 04:31

General

  • Target

    cc/PP checker.exe

  • Size

    592KB

  • MD5

    f9af3bb471626b0b164883fd40364984

  • SHA1

    2134dfb0329ed567be16aded8da7bedf9d65f588

  • SHA256

    96cb6cc90619a599c9806d649a64db4aa596c495887ae3b3db432e63082bd0ab

  • SHA512

    e0f0c447c37b57caff29ae54f99b1ef37a9416a7fa03aa15f0f66c0e7a279a495c54e768527845ee900af95e76c8c2607053c85e30d7ff85fe0a1806e6fb7071

  • SSDEEP

    12288:b2y2axB0F+IKNDleyJJ5KcZDOIOcMldpFU065lbzO4mBR:q+xB3ZL5NDzkdHUphNmBR

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc\PP checker.exe
    "C:\Users\Admin\AppData\Local\Temp\cc\PP checker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Users\Admin\AppData\Local\Temp\1.exe
      "C:\Users\Admin\AppData\Local\Temp\1.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4680
      • C:\Windows\Chrome.exe
        "C:\Windows\Chrome.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1956
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Windows\Chrome.exe" "Chrome.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4260
    • C:\Users\Admin\AppData\Local\Temp\2.exe
      "C:\Users\Admin\AppData\Local\Temp\2.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1.exe

    Filesize

    29KB

    MD5

    0fdd4db22806216eb659714c624707ed

    SHA1

    2ae1c47addc532ae856beb7edbe768b9037af1f1

    SHA256

    0e69bb1971777ebaff01f299ad0a5b70f0cf144e30b446ecc0404d03ce27103b

    SHA512

    9dfd1e8817175681ea6142ff38f64df2a68cdfb75a2f2a9e55c606d2553befb5a928ecaf7b8dae811ca588b379cbfefbcfb4611208f54858fe52d55e6213984d

  • C:\Users\Admin\AppData\Local\Temp\2.exe

    Filesize

    542KB

    MD5

    bfc57525ada107f5deb9696ab7470cd8

    SHA1

    b1467905507d386164b6cde4608ac3ea7e922561

    SHA256

    9c7a2621d03b7507d77dc9526974a81d57c47bf5f0108fbcf921c827716e106a

    SHA512

    18b4014c49999509bc4899a495a63ccefd0a1e33aa4936311557d57cb39465ba99e8279436e63d7171098bdb99a46da129ed856b6535d0eac92b0d8679ae9f29

  • memory/1744-27-0x00007FFA49410000-0x00007FFA49DB1000-memory.dmp

    Filesize

    9.6MB

  • memory/1744-8-0x00007FFA49410000-0x00007FFA49DB1000-memory.dmp

    Filesize

    9.6MB

  • memory/1744-3-0x00007FFA49410000-0x00007FFA49DB1000-memory.dmp

    Filesize

    9.6MB

  • memory/1744-0-0x00007FFA496C5000-0x00007FFA496C6000-memory.dmp

    Filesize

    4KB

  • memory/2472-25-0x0000000000660000-0x0000000000661000-memory.dmp

    Filesize

    4KB

  • memory/2472-38-0x0000000000660000-0x0000000000661000-memory.dmp

    Filesize

    4KB

  • memory/2472-39-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2472-40-0x0000000061D80000-0x0000000061E6E000-memory.dmp

    Filesize

    952KB

  • memory/4680-23-0x0000000074EB2000-0x0000000074EB3000-memory.dmp

    Filesize

    4KB

  • memory/4680-26-0x0000000074EB2000-0x0000000074EB4000-memory.dmp

    Filesize

    8KB

  • memory/4680-24-0x0000000074EB0000-0x0000000075461000-memory.dmp

    Filesize

    5.7MB

  • memory/4680-37-0x0000000074EB0000-0x0000000075461000-memory.dmp

    Filesize

    5.7MB