Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 18:02
General
-
Target
FanControl.exe
-
Size
1.3MB
-
MD5
9b94d3f94fae042147cbe5dc8009370f
-
SHA1
3116e6fa60f5cd0d580ff748d6ae0499e7534ff2
-
SHA256
6d99e5b8af7bd2312f7d3aa2e42514ceb40ed3203dfc669558e8d5d0879c724b
-
SHA512
1ee4b0a0d5a5eee964f20f875b6c0254086b4ac2925e47be64e943e4bff97be2b536ebb787dd9390160649ccda6a29f3134800901880458c407695186c5dab71
-
SSDEEP
6144:ny2M4ziRCIr+bDy/oUMs2p+pGv1xPGUD5p7aQNwul3k8+uiOiK6kU2SPSC5rII2e:ny2M/CIr+bG/oE2cI/uUjtNu/rf/3pP
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Modifies Control Panel 1 IoCs
-
Modifies registry class 17 IoCs
-
Suspicious behavior: LoadsDriver 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FanControl.exe"C:\Users\Admin\AppData\Local\Temp\FanControl.exe"1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Modifies Control Panel
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
1.4MB
-
Filesize
10.8MB
-
Filesize
9.5MB
-
Filesize
10.8MB
-
Filesize
336KB
-
Filesize
160KB
-
Filesize
392KB
-
Filesize
104KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
80KB
-
Filesize
504KB
-
Filesize
480KB
-
Filesize
96KB
-
Filesize
712KB
-
Filesize
32KB
-
Filesize
136KB
-
Filesize
200KB
-
Filesize
296KB
-
Filesize
176KB
-
Filesize
40KB
-
Filesize
152KB
-
Filesize
32KB
-
Filesize
720KB
-
Filesize
160KB
-
Filesize
480KB
-
Filesize
224KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
200KB
-
Filesize
744KB
-
Filesize
112KB
-
Filesize
128KB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
120KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
8KB
-
Filesize
1.0MB
-
Filesize
48KB
-
Filesize
664KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
352KB
-
Filesize
10.8MB
-
Filesize
248KB
-
Filesize
10.8MB