Analysis
-
max time kernel
119s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-01-2025 09:06
General
-
Target
d33789912af6003ecc2bc410d3ea5fd480cf5770b793cad3cad818457cd848a5N.exe
-
Size
121KB
-
MD5
ab922c80d97a1cb8a7240ab04c29a6f0
-
SHA1
af5942fc219edcdce2308a58eb7cfbfdaf85fd1f
-
SHA256
d33789912af6003ecc2bc410d3ea5fd480cf5770b793cad3cad818457cd848a5
-
SHA512
729e5c3b474d55c2c802df0523cf0783402aaf7841c4fc0618fdc8787b21039ce2dc3821c53db4413633b5dade0d93afae4fb7d9cf38b3d79ebfc8938f8eb7d7
-
SSDEEP
3072:927TcKFuQxqTvCIDw0x+G3dF/Ytq7xIpNelNN:KcIuamrL/v7xIpNiNN
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks for any installed AV software in registry 1 TTPs 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d33789912af6003ecc2bc410d3ea5fd480cf5770b793cad3cad818457cd848a5N.exe"C:\Users\Admin\AppData\Local\Temp\d33789912af6003ecc2bc410d3ea5fd480cf5770b793cad3cad818457cd848a5N.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\ProgramData\2dc21579.exe2⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\uym3238.tmp.bat" "C:\Users\Admin\AppData\Local\Temp\d33789912af6003ecc2bc410d3ea5fd480cf5770b793cad3cad818457cd848a5N.exe""2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30B
MD5cf6292e1717b84fefbd32183e3ef4443
SHA16f7f9456d2bd1262959553ce9dc819a6b4f6b7fc
SHA256cf32268f5c763b187f361d3d7fb9fe893f695a0194987be7e2c5458a65cf9426
SHA51263271a8af98682557d6a26e8b28c365a37477e6a789015a2c220a6b7726cf89fac510cba90ad035838657a60df4a9b12775075d2f065b9d2c0e00800411d3180
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
2.0MB
-
Filesize
196KB
-
Filesize
2.0MB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
196KB