Analysis

  • max time kernel
    96s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2024, 14:05

General

  • Target

    dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe

  • Size

    405KB

  • MD5

    2ecdf709804ba16898ef685bc2c94740

  • SHA1

    09604599e8a761a85198d823163b9e2995a67968

  • SHA256

    dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1

  • SHA512

    94728a1b711369570b0e969eb91223b4fed0d2c110cd321ecb566ea5ba36a81b9b0c8e190e70c8a02fec8ea5cd732f4b9c8e0c0b155f1cbb6e7a4468a223a123

  • SSDEEP

    6144:foYn9sE89XKTK/J6brj3nmHWrt63P5A9GJ6vbmF4ifKyjlKI4r3mzzrLVIo8ZJr6:ZsNDBIrCHWux6iFTJf4r2zPBv8Xi8xS

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 12 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • UPX packed file 28 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe
    "C:\Users\Admin\AppData\Local\Temp\dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2988
    • C:\Users\Admin\AppData\Local\Temp\dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe
      "C:\Users\Admin\AppData\Local\Temp\dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe"
      2⤵
      • Checks computer location settings
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MALBV.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1740
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:1976
      • C:\Windows\javaruntime.exe
        "C:\Windows\javaruntime.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3136
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Windows\system32\svchost.exe"
          4⤵
            PID:1612
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 12
              5⤵
              • Program crash
              PID:2620
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 20
              5⤵
              • Program crash
              PID:2676
          • C:\Windows\javaruntime.exe
            "C:\Windows\javaruntime.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4832
          • C:\Windows\javaruntime.exe
            "C:\Windows\javaruntime.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4508
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4064
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
                6⤵
                • Modifies firewall policy service
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:4060
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2984
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f
                6⤵
                • Modifies firewall policy service
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:4272
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3184
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
                6⤵
                • Modifies firewall policy service
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:4284
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1968
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f
                6⤵
                • Modifies firewall policy service
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:4468
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1612 -ip 1612
      1⤵
        PID:1472
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1612 -ip 1612
        1⤵
          PID:4916

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\MALBV.txt

                Filesize

                124B

                MD5

                163f8e838efe1d166ffff7408b814e28

                SHA1

                52fa0ccba649587e7d24d21d182657078fa6d028

                SHA256

                dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7

                SHA512

                b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d

              • C:\Windows\javaruntime.exe

                Filesize

                405KB

                MD5

                4e2f9a735f0c94f48e1aa4b91de2d3ce

                SHA1

                2638738a0bd85c3c3509e810811192fa0ebaecc6

                SHA256

                696abe4ad09e0fb27952adc03c53ba2b1b9c1fae10c9570bb6e71017be725fac

                SHA512

                85fa5bf5d5f3e730db3d7ef930626bd842b4b418fdb24a184ff3e6a4d0d4921df8a80fffdf5523b027a813c7b8b3f4130e2f2c263e44ae328cb6fcc1f32e216d

              • memory/1612-53-0x0000000000400000-0x0000000000420000-memory.dmp

                Filesize

                128KB

              • memory/2340-0-0x0000000000400000-0x000000000052D000-memory.dmp

                Filesize

                1.2MB

              • memory/2340-6-0x0000000002D80000-0x0000000002D82000-memory.dmp

                Filesize

                8KB

              • memory/2340-5-0x0000000002C40000-0x0000000002C42000-memory.dmp

                Filesize

                8KB

              • memory/2340-4-0x0000000002C30000-0x0000000002C32000-memory.dmp

                Filesize

                8KB

              • memory/2340-15-0x0000000000400000-0x000000000052D000-memory.dmp

                Filesize

                1.2MB

              • memory/2340-14-0x0000000000400000-0x000000000052D000-memory.dmp

                Filesize

                1.2MB

              • memory/2340-21-0x0000000000400000-0x000000000052D000-memory.dmp

                Filesize

                1.2MB

              • memory/2340-3-0x0000000002C20000-0x0000000002C22000-memory.dmp

                Filesize

                8KB

              • memory/2756-76-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB

              • memory/2756-52-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB

              • memory/2756-16-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB

              • memory/2756-18-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB

              • memory/2756-22-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB

              • memory/2988-49-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2988-13-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2988-10-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2988-9-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2988-7-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/3136-71-0x0000000000400000-0x000000000052D000-memory.dmp

                Filesize

                1.2MB

              • memory/3136-50-0x0000000000400000-0x000000000052D000-memory.dmp

                Filesize

                1.2MB

              • memory/3136-51-0x0000000000400000-0x000000000052D000-memory.dmp

                Filesize

                1.2MB

              • memory/3136-54-0x0000000000400000-0x000000000052D000-memory.dmp

                Filesize

                1.2MB

              • memory/3136-46-0x0000000000400000-0x000000000052D000-memory.dmp

                Filesize

                1.2MB

              • memory/4508-62-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/4508-66-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/4508-64-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/4508-80-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/4508-82-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/4508-85-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/4508-87-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/4508-89-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/4508-92-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/4508-94-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/4508-99-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/4508-101-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/4832-77-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB