Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 08:44
General
-
Target
d0bfed4c3a47cbb740ffb839f8a0ad1092ceb458678eba704a919309d828666e.exe
-
Size
52KB
-
MD5
42d54f984cbe46fdf9ce35eca6dfb205
-
SHA1
a67decfefbd6eaa2eab78cedd2a3b0d0fd41556b
-
SHA256
d0bfed4c3a47cbb740ffb839f8a0ad1092ceb458678eba704a919309d828666e
-
SHA512
e7f444ed638864fe59701a93d8c90ab5c84e0edbd0a976a1847462a8a51258f37e591ddbf0a0c21ce5377f2a7f06cfed3ff92fa1111db9fa1166ae6185d03581
-
SSDEEP
768:oRj3dfUZIyY8DVWl8zHPHXyXHCzcHHvzQBdi9vcIVSEFFoHa0ZKD:oRWIIVWl4vUv4WvcsFFoHxID
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0bfed4c3a47cbb740ffb839f8a0ad1092ceb458678eba704a919309d828666e.exe"C:\Users\Admin\AppData\Local\Temp\d0bfed4c3a47cbb740ffb839f8a0ad1092ceb458678eba704a919309d828666e.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5da3d421a7a751cabb99ecb3956de9349
SHA13b5bf7a0e8d0d20da629cf0ad0d2e0166d929178
SHA256ee03d09749e3450d3d56a274ae4a205d02f15cc55ac3b89127ab0b2663014ba5
SHA512824863bcbcf997b4f326048d8160ab86c34a3c66b4a95b9ea022e3951a6c9e5ccfcbf02a29e0b931eb7863fef51454a17dbf8e8bf4757a3b5a062d0d9781aed3
-
Filesize
2KB
MD5a48249517f2f7a1b7e87e31b58d676d2
SHA1e7e21a080b40af4df354e6dd2f5451b06870caf0
SHA25618cf01cdfe2084e965e0358192de6b8fb2abdeee6ec47f00e772642e97bc5326
SHA512fc4933d4a84671877e5c61a4b5232e6e1bb9faecb0e45bfb145f9d73be81b9047cf79ebaaaa74b95439b9559688f16f487ff1dc4cc4ba9711f3aea8357d30c73
-
Filesize
48KB
-
Filesize
48KB