Analysis

  • max time kernel
    118s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2024, 11:54

General

  • Target

    de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe

  • Size

    2.4MB

  • MD5

    dac9b9d183946c88649a4d4c1fe2a929

  • SHA1

    278a8be03b9bd20dea6db65aa3004be955d07fbc

  • SHA256

    b39c68c4aa6780541048d2449d3013f1477a5e946539766927bbe5d0c47e86d9

  • SHA512

    5051f8834a50c68facd19d309f105d21dd9746d600d95c563fd73b728551813f39b69183a3d880b2884fd0959da405d7b8470c7d245ddec4d75ae63db1a78b57

  • SSDEEP

    49152:2Ko2gzhGqxIaWeSkKkAQOQ1y7GklXRYxxTttMs+xyPFRwGJnunLp9u0XsA5cl+6M:f+zhGqx3WeSkKkAQOQ1y7PlXRYxxTtta

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 10 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe
    "C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4776
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eGBPq.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:688
      • C:\Windows\SysWOW64\reg.exe
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java(TM) Platform SE Auto Updator 2.1" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /f
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:3832
    • C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
      "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2452
      • C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
        C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2964
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3888
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:1808
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2636
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:2220
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4916
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:2776
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3980
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:1888
      • C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
        C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3248

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\eGBPq.txt

          Filesize

          173B

          MD5

          0f9512ff58185a551abc4fa80ffde3b5

          SHA1

          eb2df1adbb3504236d2857d8a9c297121c97a95d

          SHA256

          79747cbd0b884c6870d0ab8b90e4b64af598f1c1c97b2eb31c1fc1a1d6128189

          SHA512

          1f7216ce7cd2e1ae6e30c7d6d0f84b3a7a637c6cfe9568a10ffa802b99a832b3e4f45c7bd02cbbe70665e79ea917e7e9ac9a38ceaf469836fb207a47ef52ff3e

        • C:\Users\Admin\AppData\Roaming\Java\uninstall.txt

          Filesize

          2.4MB

          MD5

          68435491317e24a75700acb4c6cc5fd4

          SHA1

          79e71acc610ca385157321280adf3ed19214e2d2

          SHA256

          682392829cbe1e7fc28bff8ace8b97a5980eca1ed7650ad02757d10ee17fade0

          SHA512

          3ec337341cc3c1fa52ce3cc807a9abedf583dc9eac34e38003a594c9fb14d48d5862a898c2d7b9781d6d1b458f52c2e37910a04e44ea56089623273929085ad8

        • memory/2452-48-0x0000000000400000-0x000000000065F000-memory.dmp

          Filesize

          2.4MB

        • memory/2964-58-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2964-60-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2964-34-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2964-36-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2964-74-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2964-72-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2964-67-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2964-65-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2964-51-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2964-31-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2964-53-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2964-55-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2964-62-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/3248-52-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/3248-40-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/3248-45-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/3248-43-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/4776-0-0x0000000000400000-0x000000000065F000-memory.dmp

          Filesize

          2.4MB

        • memory/4776-28-0x0000000000400000-0x000000000065F000-memory.dmp

          Filesize

          2.4MB