Analysis
-
max time kernel
93s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 02:24
Static task
static1
Behavioral task
behavioral1
Sample
03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe
Resource
win10v2004-20241007-en
General
-
Target
03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe
-
Size
78KB
-
MD5
e8a33dff82780dcfc052d5a191052180
-
SHA1
7a8cfbfc695a522b5e4dc7c302186647ab8872d5
-
SHA256
03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6c
-
SHA512
2736ff720e44aebf3c942aea6992dd4eb60f69fe58f6de8a298337984321c35b6afa5ed5871db77099ff16611cf33f2c54fd68b80815f059755a349cd0f45c42
-
SSDEEP
1536:nLNIW39SaZTbFARlq7jC1OZstZu0TS3gEdUJCkb0FG5N:nLlbZTZX3BAtTS3gEdUJCkb0FGT
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe -
Executes dropped EXE 1 IoCs
Processes:
guifx.exepid Process 2584 guifx.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Graphics = "\"C:\\ProgramData\\Graphics\\guifx.exe\" /run" 03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exeguifx.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language guifx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exedescription pid Process procid_target PID 3996 wrote to memory of 2584 3996 03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe 84 PID 3996 wrote to memory of 2584 3996 03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe 84 PID 3996 wrote to memory of 2584 3996 03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe 84 PID 3996 wrote to memory of 4056 3996 03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe 102 PID 3996 wrote to memory of 4056 3996 03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe 102 PID 3996 wrote to memory of 4056 3996 03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe"C:\Users\Admin\AppData\Local\Temp\03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\ProgramData\Graphics\guifx.exe"C:\ProgramData\Graphics\guifx.exe" /run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2584
-
-
C:\windows\SysWOW64\cmd.exe"C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\03663294d3037bb2bb84a2bde70c5cd503e1c26a82d958d3c925f50654b40f6cN.exe" >> NUL2⤵
- System Location Discovery: System Language Discovery
PID:4056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5b984e80a9b1dacb5a72c964fac5dc9d7
SHA16dff49909f6b9ba0b63395ce8935a2a37022f8a5
SHA2565185718249aeeeb74f5ad2de8b56cc624f86836e51eeb01d904e2e57025ac039
SHA512d947f16eb5cc5803fb96389091bd9ef0a5c5e1ebd3212825f2f2f004168f7c369f1ed106d9ec60b1d1c7207646bd375c61360299000e8b501ad99ab2e0595c33