Analysis

  • max time kernel
    118s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:29

General

  • Target

    48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe

  • Size

    102KB

  • MD5

    0e540262593387d5ef74e5ea9b1cf920

  • SHA1

    9b2b9467a84d4696820879a5e1dc229584770de0

  • SHA256

    48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bf

  • SHA512

    ca9c4815a571c27a68ddafdeec0523741639e477e6df95da04be035812b5d2990cc186264fbf10dbd45905b4a140bad97c454b9e90b0bcdc7abf2139f85fdec0

  • SSDEEP

    3072:xFphTfm1UC7AdYzrV+Dljy/32ubwZZqJ:FhTfmuCkdYzrVolu/J0ZZ

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe
    "C:\Users\Admin\AppData\Local\Temp\48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4100
    • C:\Users\Admin\AppData\Local\Temp\48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe
      "C:\Users\Admin\AppData\Local\Temp\48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4844
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ENXVF.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4120
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "sidebar" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe" /f
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:5012
      • C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
        "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3328
        • C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
          "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:812
        • C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
          "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ENXVF.txt

    Filesize

    157B

    MD5

    f6a90c20834f271a907a4e2bc28184c2

    SHA1

    36c9d1602b74f622346fbb22693597d7889df48d

    SHA256

    73f29cd953eee40cea4de67842556ffd96efe8094a6a9b70f33a35df2582febd

    SHA512

    39cabae19fe1faa37455e4bd242c868be60d6252b07f01224b3f7501c3cf734e503300b840d83381a452707cab6df2f95f920655884be56d4024676b26943804

  • C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe

    Filesize

    102KB

    MD5

    a4d112f962410f1813630675c40f9d0d

    SHA1

    18dcfe79bb20f0868c4225ae3241ee01a3c47a64

    SHA256

    a8a692fe6a40b2fdd81081dfa74efc21083dd17bc6fd1ec566fd13520da3840a

    SHA512

    92af46a5a1af4a13ee8cd6c91c9d421781ad8c88a164ddfc52e612073e75941bd0a70a6c722d038798ed3d407d884e095003573e8fb421a82bcb01aaa30c7329

  • memory/812-61-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1848-50-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1848-57-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1848-63-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1848-52-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1848-53-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/3328-43-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/3328-42-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/3328-44-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/3328-37-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/3328-58-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/4100-4-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/4100-13-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/4100-0-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/4100-6-0x0000000002C40000-0x0000000002C41000-memory.dmp

    Filesize

    4KB

  • memory/4100-5-0x00000000024B0000-0x00000000024B1000-memory.dmp

    Filesize

    4KB

  • memory/4100-3-0x0000000002470000-0x0000000002471000-memory.dmp

    Filesize

    4KB

  • memory/4844-9-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4844-40-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4844-59-0x0000000000410000-0x00000000004D9000-memory.dmp

    Filesize

    804KB

  • memory/4844-60-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4844-12-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4844-7-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB