Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 19:47
General
-
Target
09e1a93254061a6030863e6717e7e7af2425de58d2f74f92123fc10389832b69.exe
-
Size
31KB
-
MD5
2dbbfa3d43fcc1f9372862b09aa1c691
-
SHA1
32473a1a97d918ffb998846b3ec644188b9c8fa3
-
SHA256
09e1a93254061a6030863e6717e7e7af2425de58d2f74f92123fc10389832b69
-
SHA512
53383621d431910a01cfae06983241c018a03874095622f3632a1d46f6a9c62fb6c0bb2afb365d5d78af3965f691f753bfceabef63dd61805b6166c82c63e3cf
-
SSDEEP
768:bWj3dfcZIDhC/uWxDVWl8zHPHXyXHCzcHHvzQBdi9vc:bWuIZmVWl4vUv4Wvc
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09e1a93254061a6030863e6717e7e7af2425de58d2f74f92123fc10389832b69.exe"C:\Users\Admin\AppData\Local\Temp\09e1a93254061a6030863e6717e7e7af2425de58d2f74f92123fc10389832b69.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD50f61a31c04f27ded24fea7be15a048a7
SHA1c07e7cb3bb126949a640682037d59b13a54bc564
SHA2569ee0ea53d61368d8ccdd91d64dfb27cb6184dc4dace82b75d86fd9c483c35c21
SHA5121992f93ae64ff98cbd368ce9ecfef48edb024624fdbefd3f19e5dbe765247885357a785c3db4c5db346c3259d35de9bf2c0ca75a3e224f105182bad25e7f11e6
-
Filesize
2KB
MD5a48249517f2f7a1b7e87e31b58d676d2
SHA1e7e21a080b40af4df354e6dd2f5451b06870caf0
SHA25618cf01cdfe2084e965e0358192de6b8fb2abdeee6ec47f00e772642e97bc5326
SHA512fc4933d4a84671877e5c61a4b5232e6e1bb9faecb0e45bfb145f9d73be81b9047cf79ebaaaa74b95439b9559688f16f487ff1dc4cc4ba9711f3aea8357d30c73
-
Filesize
48KB
-
Filesize
48KB