Analysis

  • max time kernel
    93s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 02:24

General

  • Target

    03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe

  • Size

    78KB

  • MD5

    e8a33dff82780dcfc052d5a191052180

  • SHA1

    7a8cfbfc695a522b5e4dc7c302186647ab8872d5

  • SHA256

    03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6c

  • SHA512

    2736ff720e44aebf3c942aea6992dd4eb60f69fe58f6de8a298337984321c35b6afa5ed5871db77099ff16611cf33f2c54fd68b80815f059755a349cd0f45c42

  • SSDEEP

    1536:nLNIW39SaZTbFARlq7jC1OZstZu0TS3gEdUJCkb0FG5N:nLlbZTZX3BAtTS3gEdUJCkb0FGT

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe
    "C:\Users\Admin\AppData\Local\Temp\03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3996
    • C:\ProgramData\Graphics\guifx.exe
      "C:\ProgramData\Graphics\guifx.exe" /run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2584
    • C:\windows\SysWOW64\cmd.exe
      "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe" >> NUL
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Graphics\guifx.exe

    Filesize

    78KB

    MD5

    b984e80a9b1dacb5a72c964fac5dc9d7

    SHA1

    6dff49909f6b9ba0b63395ce8935a2a37022f8a5

    SHA256

    5185718249aeeeb74f5ad2de8b56cc624f86836e51eeb01d904e2e57025ac039

    SHA512

    d947f16eb5cc5803fb96389091bd9ef0a5c5e1ebd3212825f2f2f004168f7c369f1ed106d9ec60b1d1c7207646bd375c61360299000e8b501ad99ab2e0595c33