Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 17:47
General
-
Target
9c4c6cb7b00277f25a7bac783e7cf06813e78d99dad35e6d6781a158fa9af8df.exe
-
Size
52KB
-
MD5
7a9da66a18df388a3dc53f0fc32fb3a6
-
SHA1
9fecba5d4f76cf95a827040bb6b31d59faf1a105
-
SHA256
9c4c6cb7b00277f25a7bac783e7cf06813e78d99dad35e6d6781a158fa9af8df
-
SHA512
95a9e8f0c2842f57fb8f7be7e4cee994d67361a96ff296145631366023794a5152e37988260810c681bbb7fc05a3fc001a9d4fa9cdac9fa484a57583687b673c
-
SSDEEP
768:mLj3dfkZYcuF81a/DVWl8zHPHXyXHCzcHHvzQBdi9vcIVSEFFoHa0ZKr:mLuYYgVWl4vUv4WvcsFFoHxIr
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c4c6cb7b00277f25a7bac783e7cf06813e78d99dad35e6d6781a158fa9af8df.exe"C:\Users\Admin\AppData\Local\Temp\9c4c6cb7b00277f25a7bac783e7cf06813e78d99dad35e6d6781a158fa9af8df.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5ec3b68930e235785256017830dae455a
SHA15fa28608b89339e8ad567a4e1809a9446cedad59
SHA256f1abfb6b81149aec1ae47d3324b78f75c74ab66a1cd46b9a4fd48f8dbaef58f3
SHA51219afa0a62d1bccb266e56761bc4f8992cecf4e23599ed684b9fa4aeb53f9a610cade573490ee1a81e7acee84d3ad776e1b5b6483e60b9eb0dd913291e5df740e
-
Filesize
2KB
MD5a48249517f2f7a1b7e87e31b58d676d2
SHA1e7e21a080b40af4df354e6dd2f5451b06870caf0
SHA25618cf01cdfe2084e965e0358192de6b8fb2abdeee6ec47f00e772642e97bc5326
SHA512fc4933d4a84671877e5c61a4b5232e6e1bb9faecb0e45bfb145f9d73be81b9047cf79ebaaaa74b95439b9559688f16f487ff1dc4cc4ba9711f3aea8357d30c73
-
Filesize
48KB
-
Filesize
48KB