Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 08:48
General
-
Target
d0bfed4c3a47cbb740ffb839f8a0ad1092ceb458678eba704a919309d828666e.exe
-
Size
52KB
-
MD5
42d54f984cbe46fdf9ce35eca6dfb205
-
SHA1
a67decfefbd6eaa2eab78cedd2a3b0d0fd41556b
-
SHA256
d0bfed4c3a47cbb740ffb839f8a0ad1092ceb458678eba704a919309d828666e
-
SHA512
e7f444ed638864fe59701a93d8c90ab5c84e0edbd0a976a1847462a8a51258f37e591ddbf0a0c21ce5377f2a7f06cfed3ff92fa1111db9fa1166ae6185d03581
-
SSDEEP
768:oRj3dfUZIyY8DVWl8zHPHXyXHCzcHHvzQBdi9vcIVSEFFoHa0ZKD:oRWIIVWl4vUv4WvcsFFoHxID
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0bfed4c3a47cbb740ffb839f8a0ad1092ceb458678eba704a919309d828666e.exe"C:\Users\Admin\AppData\Local\Temp\d0bfed4c3a47cbb740ffb839f8a0ad1092ceb458678eba704a919309d828666e.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD58efbb49d0e78ac5d423e16832e1ffebc
SHA1cdeba1e17f22b357d2e949b411d19e4f49c057d2
SHA2561bd409e3f16ed80e60fc1981e67a28387aa8e282809375a3edfdb89be71b5782
SHA5121e2d00fe9489f50f1cd84aaf8ba2e143b8bcf35f337fa146b22f3cabdc1b1008f235b9e30ea35e235dd4a9b092cd237ed091cdcb5310b5eac728c40335d031ee
-
Filesize
2KB
MD5a48249517f2f7a1b7e87e31b58d676d2
SHA1e7e21a080b40af4df354e6dd2f5451b06870caf0
SHA25618cf01cdfe2084e965e0358192de6b8fb2abdeee6ec47f00e772642e97bc5326
SHA512fc4933d4a84671877e5c61a4b5232e6e1bb9faecb0e45bfb145f9d73be81b9047cf79ebaaaa74b95439b9559688f16f487ff1dc4cc4ba9711f3aea8357d30c73
-
Filesize
48KB
-
Filesize
48KB