Overview

overview

7

Static

static

3

ed79100c1e...0N.exe

windows7-x64

7

ed79100c1e...0N.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2024, 10:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed79100c1e1051ddce0e08da195154ff4ef2cbb73ae650251596c5d135f89050N.exe

  • Size

    93KB

  • MD5

    e4a98e87a9335207fd785a7ac84d8c90

  • SHA1

    ae86720e0e0e70a277cf15714f90c5b41f0bb4d9

  • SHA256

    ed79100c1e1051ddce0e08da195154ff4ef2cbb73ae650251596c5d135f89050

  • SHA512

    6c06cc4a6580bdd44599a9fe68d94e53fd648fa2aba736f88ea73b3308e94abc084cac58dbb516a1f1b2219c4e3f5bb2bcadf7fac42208821353057b7cd207b7

  • SSDEEP

    1536:OUMTIGU8vM3dG7l5rphVgEQF5NM4Jt78eRL2h+nhMJ41me:ObTIGbvM3dIhVYFU4JtVRqYnCJ41me

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed79100c1e1051ddce0e08da195154ff4ef2cbb73ae650251596c5d135f89050N.exe
    "C:\Users\Admin\AppData\Local\Temp\ed79100c1e1051ddce0e08da195154ff4ef2cbb73ae650251596c5d135f89050N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3220
    • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
      \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3456
      • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
        \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2828
    • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
      \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1464
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v COMLOADER /d "\\.\F:\Program Files\FoxitReader\bin\COM7.EXE"
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:3688
      • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
        \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
    Filesize

    93KB

    MD5

    28c0f9af32cdc3e8a0f1e62ccb8e5456

    SHA1

    57cb04eded4253deb6d700b271f6cab6abeff485

    SHA256

    18c34861276756bd6a47064515bf5b75134f9e27b51b96827583820eb72e961d

    SHA512

    0ece5f28f3925bc00c3ebd46fa334d8af8aee30b695e14aab4575ce67b533ebc9b1332a8e9fc59f012fc48fb570b5607ceb85ba72fe394a738d41362d7359f33

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
    Filesize

    93KB

    MD5

    f841e1e0491bc2a28d236d2e354c5ec8

    SHA1

    dcf6de402c0847f6c4de1b0107efa4590e55a3e8

    SHA256

    25692a06e1db703ac4102a7084e0cd25cb1cd24cf1725b439935a31cd625a0ed

    SHA512

    d64d96b099cb9f650968978adba0949a5e0764545eecb1fadb7cc094c5af48671d861a00ed48ddae241cc9fe1f2d54598b99e5cc92277a1c7f9e9d3ce2867020

    Download Submit

  • memory/1464-18-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2828-27-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3220-11-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3456-15-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3456-31-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3868-22-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

    Download