Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 00:19
General
-
Target
74d3fc2a95eec72b17cf436a1f9d5ffc42727a8190db21cfea76cfd8b92a4243.exe
-
Size
52KB
-
MD5
45d202dd76b10bca0c5af7b100d0395f
-
SHA1
3884896881c640f35cf44c25573d2fe58fff93e2
-
SHA256
74d3fc2a95eec72b17cf436a1f9d5ffc42727a8190db21cfea76cfd8b92a4243
-
SHA512
ce77bf32f5fcf992298fa69e31f350b531c4d3b6a997d2a4c3fb418d77532b1ea9d9f84c14241ea4fe7969460e5eef126b1f88a1bdaf5f23cf3907fc20a0cfb4
-
SSDEEP
768:CXj3df4ZEux3A/NX3jDVWl8zHPHXyXHCzcHHvzQBdi9vcIVSEFFoHa0ZKT:CXCEu+VnVWl4vUv4WvcsFFoHxIT
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\74d3fc2a95eec72b17cf436a1f9d5ffc42727a8190db21cfea76cfd8b92a4243.exe"C:\Users\Admin\AppData\Local\Temp\74d3fc2a95eec72b17cf436a1f9d5ffc42727a8190db21cfea76cfd8b92a4243.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5e8f3097ac8c15f542661168b4c12798f
SHA19e3f30abbbaa653aaa6e1841db46bd9ccd402dfa
SHA256e79f574057fe7409dac79b9f240506c4660efe47379284329a0caf2ff4fec1ca
SHA512e34c701bab2f4a54a2437979ca3c264e33546aec6ddb062d45653a8d7ffad487da300a9cfd44d7efdf89a2afe7727942526d5603645e34ed94b10de81901de4f
-
Filesize
2KB
MD5a48249517f2f7a1b7e87e31b58d676d2
SHA1e7e21a080b40af4df354e6dd2f5451b06870caf0
SHA25618cf01cdfe2084e965e0358192de6b8fb2abdeee6ec47f00e772642e97bc5326
SHA512fc4933d4a84671877e5c61a4b5232e6e1bb9faecb0e45bfb145f9d73be81b9047cf79ebaaaa74b95439b9559688f16f487ff1dc4cc4ba9711f3aea8357d30c73
-
Filesize
48KB
-
Filesize
48KB