Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 11:17
General
-
Target
ebeba6ca66f2de14808fce8857b8e2f5b4bdcf4537c032c97093e761d27ac4f3.exe
-
Size
50KB
-
MD5
97db809e825cee055d3e79a0bd937fff
-
SHA1
96b6e7fdf0c6dc32b8deb0711f888ee7bb0dbb06
-
SHA256
ebeba6ca66f2de14808fce8857b8e2f5b4bdcf4537c032c97093e761d27ac4f3
-
SHA512
87f9350f3533c05110e073ce21b1f6c85941ac91da3ea032198888f7be465285b404f78dc83e1e071ffa5808821674278226823f049f92d88596733ef19450f5
-
SSDEEP
1536:SxGPLTFI0GCfUQv+xhWylmBaqFsJC5F5BzXUnwzjx/u1bmtlokMfGXf:tPLRIQU+qhwFD
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebeba6ca66f2de14808fce8857b8e2f5b4bdcf4537c032c97093e761d27ac4f3.exe"C:\Users\Admin\AppData\Local\Temp\ebeba6ca66f2de14808fce8857b8e2f5b4bdcf4537c032c97093e761d27ac4f3.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD5f648fe7039c5d09c878d1faa875738ab
SHA1bd8a4f95d0649df4076e3e7510c58f85e672ae3f
SHA256dbf5ea91823e105a1a6eb504817eae12ca628b07fcc06b0fe57f65c56d6e106d
SHA512a215c1f3d050ff02b5fbf08bdfaff0ecc51d5b6dc2fa43b6e30d7e8144e66741d6b6fd38e4cd6f892194632f94bc7a64c6f70ce225022cc122097c7a049cc3e9
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB