Analysis

  • max time kernel
    120s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 05:14

General

  • Target

    ec7ba5d18a4cc20171369ee9720e2c3198172a23b0d098234ac3f7fa4072a54eN.exe

  • Size

    42KB

  • MD5

    f2128fe384c2b474aa6c6656b967c250

  • SHA1

    c1bff657915f937b70c71348f64494a3791bc7eb

  • SHA256

    ec7ba5d18a4cc20171369ee9720e2c3198172a23b0d098234ac3f7fa4072a54e

  • SHA512

    39b711228c7e2d4bcbc08345277f0003410fd71463a46e1367de4dd4eef2c3c3c29712a0dd2cba928a00ab27eeaea474b49a4fbc31cb6f870a0b4b0d8a9b6640

  • SSDEEP

    384:gstrVTkkymwQPOMx/PLcbSYOfUXiURFLmjoiIRxSXZHno8wJ+T3ivTVD9iDn8U:gcTkkrwLA6lvXiURdmPt5wcSvJD9iX

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 43 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec7ba5d18a4cc20171369ee9720e2c3198172a23b0d098234ac3f7fa4072a54eN.exe
    "C:\Users\Admin\AppData\Local\Temp\ec7ba5d18a4cc20171369ee9720e2c3198172a23b0d098234ac3f7fa4072a54eN.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\windows\alg.exe
      "C:\windows\alg.exe"
      2⤵
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3892
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Windows\temp\*.* /q /s
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4396
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\EC7BA5~1.EXE > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2360

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe

          Filesize

          177KB

          MD5

          d8220cf3b3bdfdf6408e0e1247260c54

          SHA1

          d6d4813c9c1c26a70070f13cf1bf1e3f64e1839f

          SHA256

          730dfca88b5e1ab72d2efeb6c1c9a5390f49d0a66205f701ea9b4fd041a36090

          SHA512

          762c35275f8ba3aaa6e23aa140df7fc25368e2aae2acdee50b5f940412e05a725e69fdd7ad9471f1f815f7adf138043877a3ce2520e7898ed85cf3e2b4881106

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe

          Filesize

          287KB

          MD5

          a5a1e89d922f9d0e308391abd1e1e35b

          SHA1

          4480fdbbe4825a63bf8da81617b8d48cdfaf8fcc

          SHA256

          15052c9984705a582e4618b604cf02bd0c58faeef3698caf4a9735537f2e5e80

          SHA512

          86b0f35a89bad9b797f651043794a2a596e6c84c662ba7b58ddf354d3cea11ea97890e971477a092a4b0dc781e929a00aa0628ae2a2957eabfd009f34e0ccbca

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

          Filesize

          9.4MB

          MD5

          14a5d83316e21d9c61d829d4456d838f

          SHA1

          55083a20ade81d2e6532b7065e5507ce56fc218f

          SHA256

          d2f773a9f4d8f94803ad677071f9b368621271f0ea44e2ead0a558a3e360311a

          SHA512

          ab21cb06d76af11f57ec31dc78bba56ccd6221529a7fd3eadcbbf3de4391c178d92cfd6e07b91a4180df2273ed37ad480632b8fbac44c8224bb3fbc8c1b39fb7

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

          Filesize

          9.4MB

          MD5

          b55d25175a92201c1c772b65c9ad2f05

          SHA1

          89314a76d70440b58e65177f101c402a82fc530e

          SHA256

          54907e882afd47268f893dbf10bb3d03279b5e9e43704d7fb35742be9b571e20

          SHA512

          1f652695c05a4214d471c592b3cf26064606112217268a49dc17d1f699071c3b1866806ee90ca9951805ab8e724b78bb4ec65ae6caa3900f20fac2b48c63cfc6

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe

          Filesize

          24.9MB

          MD5

          271db4f4d53208d081b5ded4c4057fef

          SHA1

          49f8ef3fe8b9b092bb03656e14dd18cef5ca0d3f

          SHA256

          01f4b71424a2998f9aaeaf02810dcd289f4b0072e8220e99d9618c21c9739b6e

          SHA512

          a8c65b1613877cbe7478b366962ae403a45c2f55b397b1c374c60d76367281eb9412596e0315a2656e315866754ca1bcee105df7dc373ccefb458acc53eebac9

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

          Filesize

          2.5MB

          MD5

          8b2f441d39fddb3cf7397dfe8e2581d3

          SHA1

          54c91e47520d94d61a680729e5a441467895518b

          SHA256

          d81052f225b6cc1067eb9a05b94915fb7246b97e7263072081b5ea267189b180

          SHA512

          89d60c2d4bc4946fa9cdc096d513d720ea48f5251d9d8476b03f4278c8ceee851976d44973f2bf3d2345046937c2738c4a75032969e53aadd9fdde6d666b2a9e

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe

          Filesize

          70KB

          MD5

          bf3f0690c0a9966b5c6fb4af9e48166d

          SHA1

          aa2a40f788d247ba12278f2281b453dc0d684466

          SHA256

          42c7fcbae2f7c1ba8a237288c98de1b10c54ed633d39d13ccc1c692b351e9485

          SHA512

          989d7b3eea6f931a7c648b5a874b1dcefce89104601cecedf2863aace12b65842618193c16ce8e43be1751c162a8569d29ede018e728e791e708e063560788e4

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe

          Filesize

          88KB

          MD5

          02ed374aa771882c6c4bcd30eee46a28

          SHA1

          640e534fd349dee5ec2de069850fb5556e0fd551

          SHA256

          c08b7628d9976b6ab2e35d145b30c6b7788517c86eacdccce618af4bea7542c0

          SHA512

          33ee2a878021734aebe32721c2b7ea880ff621ebbd0d7eb6657f3569bb83c4ba281be2ad58267002dca55c3fdf16a033142db6f7100b9d3b55a27fefe5a449e7

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe

          Filesize

          5.7MB

          MD5

          bbc7454df6419791c040042069a7bd7a

          SHA1

          b4e48387cc88ff619d67c713cb854326fc2fed4a

          SHA256

          137add95165f73728d532e0c50710cf953dd5056ad8aa5077bbff6be344593d3

          SHA512

          9053d4182250321e2d9e12fddda041b1995e0cdacf8f33b1a6214baa0142b1eb74e3366a144b37758037a37bbd9192ff314866d23bb530744958ec9b7e2af1a0

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe

          Filesize

          5.7MB

          MD5

          f5b45434157089cba1e5668b154b4930

          SHA1

          69dbc12e5a860b525e91d48c7604c3f8033fa8fd

          SHA256

          20d973bc2bb21527c55274441e04ce8239f590651d749750a0efa4d1300f7e4c

          SHA512

          f715b6a905b77727c2343f1a2647d7dd8db4921c0f1715b4de7468a12712f746a36bf30291bae3f7848847d8a3006634131256d8ca4a164765e4706f9e713390

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe

          Filesize

          185KB

          MD5

          c0d68b17623d4a63beff07670fc357e4

          SHA1

          38a09d33c3b142ba434aa430428e087212a92764

          SHA256

          9283b9c34ca1bffb93ab39f239df13112e38b3e928c5b63c134e2f9be199ca42

          SHA512

          b28439310c8b5917e1a433a63545120bd374261d42f2fdb2d1a84c0aacdf75c031f5f5913f7adceb0c619cd377dfe5c92896159b7d3770ea57e3cf01ef389f39

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe

          Filesize

          91KB

          MD5

          f336e81d7c3c4af681dfac497ccc6aab

          SHA1

          d8760fa2c4a742d3d3ab8133dcb806178a633e1b

          SHA256

          ddd1ce2a24fc6016176cc5be4c38a5c04532878f79e5b5a34917c44f94efb110

          SHA512

          f938cff0406298add1bdebe462ad0ae0e5f670248a603880e206e86be33956d36f3e1919ec00d1cb0af9fc963d6720f0f606383ff583f373862a9eab5d4d9f2b

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe

          Filesize

          255KB

          MD5

          c787fb105d16476c990784e460e1c7bb

          SHA1

          5854c1fb551d13a466a4a415ef4d5d51d2b0c358

          SHA256

          2fc7b20f1e4fee266ba31fae8c3d7f783afb9abf83580c2d22d5ed758327766d

          SHA512

          503345deb30dcd2bdf72a1ba15d379ee4ee1cc4cb382d074c920156e6af007bdb967c2a84db3269fd56b08e9bae29a447669dda99b2b5f022c63f857ac6fdc76

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe

          Filesize

          345KB

          MD5

          6623abd95d6ca5b4e9d78570d1e531ad

          SHA1

          dd734ce4057e98af82197af22a436b3ae05e1af9

          SHA256

          db197e4e2d60b8161a5cf5c41a9d3d1d5cc694c19fe96d71e33747dd20c1d4b3

          SHA512

          77624baf530a198eeb708b5d28cd536a8314101a23e8b9570699f35d4d962f47e1537ee283efb09eabaef4cf5c0523a9388d37a64f9e926c580028454d65d45f

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe

          Filesize

          126KB

          MD5

          945f70a339c02f62367b6b91d70b5302

          SHA1

          5ae0091e68a95b6837c5b3877c1dedafc0685e0b

          SHA256

          76ed17ee80333fd0bed4bc9ac4f778273c30c9fb2cd988da36a098836e0d30eb

          SHA512

          7056bea3235a823565238150bfa63ee31d363dd167c5e4afa838ba3c463612dee0f1fd6e03e6c6d5136aa6d6c462c24dec78bd1592a46110f100249a5ed3d56a

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe

          Filesize

          144KB

          MD5

          6459c415c8057eee0e2f9e09248b0788

          SHA1

          147299d7287e189af5b1e68fd56b29945790288c

          SHA256

          1492c1b6340a4b495b85ea7a5ec0a3b48d8f87e936938db3c28b67f9b73159c6

          SHA512

          3fdc770ce320cecc23eb56359b96b9a5765d5c62c0a26d0efe6fcb6e7a663af063b35e0e096dde62bd084511d5913c818a33c95bc2c7e2536a2b88da05dac469

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe

          Filesize

          279KB

          MD5

          b190797fbf932bd613084e30ada19612

          SHA1

          da1bbcadc4034e84cf306fd57387833619d70d58

          SHA256

          5aab9463ca3765a4d92aff5e6591fab2f7403baad57d2bdb2bcda3aa89f4bd9d

          SHA512

          7f08ba34a10aa83e3f8e8eb283254513847e585410079ec5decded75feaf3fe1a86783bba96b9b29da186d3a3cbbddcd7993ffecd127fdf96f395ae546b6bc5c

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe

          Filesize

          52KB

          MD5

          fafcff087a9a2e0bc5097f1f18daac62

          SHA1

          f5c323c8a28d1992ea074a1dee6ecc1beb749c69

          SHA256

          8bed44823706382b3848534e1cc9d26d90511d1f195fc08f6be0045f415377ce

          SHA512

          30e43cab53dd0ad56a27532bf1cc832ad1f06120559c06eb298f59da5008e448a60396e7d7937451f4b7fdfb02e128b8c8765f52d1e0a3b65d452bd3367d49b3

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe

          Filesize

          107KB

          MD5

          a77340ccc7475a541ca0fa36b410bbd0

          SHA1

          a387412ffab19b206700d86d3709230bd55e9641

          SHA256

          148c2a561257b994fe0e1606653e8ba80b1ef53dcfe05e914e060d6f5c6e3970

          SHA512

          4915969a0690719b0631963aaec3452f533ee8a66c5e30f22104a1c1623f0e00958c7e6b257235f78787ed505af92be44cd7fe06e9111cdc432bc1df7b63c230

        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

          Filesize

          1.2MB

          MD5

          d6bd9881875e0f56aa00a28d777b3afd

          SHA1

          2c04eb10913fc5321988064a1a5a645423aab159

          SHA256

          9f25c4d0a9770a2772aac0ea36e213d152a8024c6ba18c219f9ffbd0b5de57b4

          SHA512

          d184c5935cecb095a42583a96cc5f8bb1dd3e3dd1b76ef5eac21ec22145753f330861f23d1625d98e6e7e71deb0e5d51a3eb8374b34d32b04fd77771141aa509

        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

          Filesize

          1.2MB

          MD5

          5f4acee947beb23f04d9599322c47cfc

          SHA1

          1c39b1aaae857cb352f1e4a7d2295508fc300f8c

          SHA256

          9b589e570ce599a1fda95f583f61b23d4c0d193302f6000bacc6a0db1f218bd0

          SHA512

          1032cf200b912e670af3c650d25fd278ef38f678aa84d81f3d4a8873ae494dfd9fe3f2a20f70b132c501d83974be84c8f7355058341649dd47a74397b86ffd2f

        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

          Filesize

          455KB

          MD5

          1de54c2814da9588027386bb14bb0f1d

          SHA1

          24b493a0d6045a34fe5cf0885f8e4a7048be99fb

          SHA256

          f9a3bedfa54cd2e612d63bd227e09704e7af8827ab04fe2b4f8cea9fcece6b0c

          SHA512

          5928e344cbee629f271e72c2ca3e635d1a0bece93e89830c7586c33ec4c275068aa89a5d00a18daba86cdf65cd371bfda88587f23adcd10b0df65e619ec4a94f

        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

          Filesize

          455KB

          MD5

          7f616d7458f170901c4dba26cab431be

          SHA1

          12ba3b464909189a3bb5d7164de6bace7f0a8386

          SHA256

          d50ff428c62f88dfe27d0c6cf77eb714e2dcba47fb2c932970e6fb6f5c960a1a

          SHA512

          333e244f928c3e88d29a58c3e5a669adafb02d64e0ad3b42bd48791a722794143de89767a4619955daa5abde3f127ddae638336d0676c513d68ce1cfa05cb7a2

        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX6C20.tmp

          Filesize

          45KB

          MD5

          ca6118f28b7c3b8e37c543ef974821e9

          SHA1

          2f60dd3d730ffbcaf1282f6d1ed24a6f4d21280a

          SHA256

          5ad87c88da15602fe7d6ca05ce80d369ee3e298e3ef6717c8305a3bb69c0be44

          SHA512

          c303ca4d1ab93c9778eaa4eb9327191637922afe40f33d19d3dd11312cb6eff1a70619515b9e9796863c19801da4aa4bf11e183339b7e7c5c7f0456d6a77caa4

        • C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

          Filesize

          514KB

          MD5

          5815e92687ebe087464ee1b2ec2ae9a9

          SHA1

          051e132c8c13d0a3d2b3cbece3dc12a6f6087df2

          SHA256

          a3554c0aa5b520fd6bafe5a51315af9fab83fc98d1a57cf24004656acb479f8f

          SHA512

          4b389cdbd06ef8f7513214756e7fe0ebceef3e09877f41192919981b97bf7dad0bc6f94948e2ec3f4f286f0b1aca55c69d1e37f80ab2f4a2c60f8033ab1b9b76

        • C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe

          Filesize

          80KB

          MD5

          d2a9beb443467eac08a7f069b8e81114

          SHA1

          7b9fca8e0c3eb8ecc874eae7b6da000980ba7c42

          SHA256

          b7defdbb386b421f6cd4d380d051c0b7d738b89d6cba3b5b70144f40c9409e55

          SHA512

          efeb2d0bb36f575909d6d3c44444200ff833dcbd2e98240d63a4c498c40123388001ccde741e84cf292d0875f8543dbeb174eb86149c9aa9c5ba79293d7d9ad2

        • C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_87484\java.exe

          Filesize

          327KB

          MD5

          ceafc7bb4274b5595c713f1a15394b5e

          SHA1

          ce685a5528155acf2e6631f66ca48ef514a62727

          SHA256

          a00f66e1b20745fdf04c8525df7a4033f69ad0a24c86b419d2ef1fdd99b7596c

          SHA512

          5e37efa26d018601c479f8bf5e81f6b15dc01eb15fc9b70f315526251ebfec2f15ceb17758c5d9e712059a0e3ac34d7f89b514d401922d8d974638cedf05736a

        • C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_87484\java.exe

          Filesize

          327KB

          MD5

          91dd5967805bbd43ec8a8009ed580f81

          SHA1

          d468f548a04802cbc60de96dd54bf73dcf7db615

          SHA256

          6c833b375c04f7449619597cdc54933787c7f80f9aa55581bb6c4439411e3a52

          SHA512

          04b281988cabfe8a3bf7c7c8a8dda3fb51930ee682d406d60f305feddd802642d3409aec1deeac36f5dc53c2a1ac9dd1f1963562959f18bcf4dedf3da698fad7

        • C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_87484\javaw.exe

          Filesize

          327KB

          MD5

          2b77eba99bee2b51f35a446dc37c3be1

          SHA1

          e5392a754c5b857e8c8c14ae3adfa1a17bdc8179

          SHA256

          cae4670dd68fe5b255c5526555d3dab6c3cb379f8ff5b7dfae68b3934b9dbab1

          SHA512

          08a7b12b6d8a622e66d5c0cdb8c4e27b3ddc3fb95b16cbae472f7e02840d378f2e70436d55f966ab99efd7f739e1865afad3c200c1b709b14a17ac05176029ee

        • C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_87484\javaws.exe

          Filesize

          465KB

          MD5

          0b38ca1d466c8533026d667c3281c1a5

          SHA1

          e374662a449dab9ef6917e872c68730d501ae736

          SHA256

          1a12fb7e54396631be8f84ba5f4f3c9713025918c6d5c3a3cac58b65803e5f46

          SHA512

          fa46110e7e603f277916fa84c5487d00f2b640ac206ecd58246f312e11a177281a060776bd7ce07d306591db73ce88e84dc38418c0bb175998895c2166acf427

        • C:\Windows\alg.exe

          Filesize

          42KB

          MD5

          f2128fe384c2b474aa6c6656b967c250

          SHA1

          c1bff657915f937b70c71348f64494a3791bc7eb

          SHA256

          ec7ba5d18a4cc20171369ee9720e2c3198172a23b0d098234ac3f7fa4072a54e

          SHA512

          39b711228c7e2d4bcbc08345277f0003410fd71463a46e1367de4dd4eef2c3c3c29712a0dd2cba928a00ab27eeaea474b49a4fbc31cb6f870a0b4b0d8a9b6640