Overview

overview

10

Static

static

10

e4a80728e6...5b.exe

windows7-x64

1

e4a80728e6...5b.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    134s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-06-2024 12:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e4a80728e6f8efdefc6f75560196ceda43d8835b1038feccd6b132cbc6ff6b5b.exe

  • Size

    9.3MB

  • MD5

    a8b40d4763f08d51bfed24d0bf258d0a

  • SHA1

    2d949f75673e7489ccdabb266134a951dbf5586f

  • SHA256

    e4a80728e6f8efdefc6f75560196ceda43d8835b1038feccd6b132cbc6ff6b5b

  • SHA512

    7ad834243e35af6ecdafe253bffc7b80d2020737e92ad0a82fbb881fde4506c7e6759e05e114ece6c91eda6f3877d4b6ede4a11d73ec4b20b383648b5f42f5c9

  • SSDEEP

    196608:nPRWJbVQPXVB6F9xnRE3PHBDmsqfMcTKyb0qJQmhp:og/VB3VEdsC7

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4a80728e6f8efdefc6f75560196ceda43d8835b1038feccd6b132cbc6ff6b5b.exe
    "C:\Users\Admin\AppData\Local\Temp\e4a80728e6f8efdefc6f75560196ceda43d8835b1038feccd6b132cbc6ff6b5b.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Users\Admin\AppData\Roaming\Load.exe
      "C:\Users\Admin\AppData\Roaming\Load.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2996
  • C:\Users\Admin\AppData\Local\Microsoft\PaneTool\PaneTool.exe
    C:\Users\Admin\AppData\Local\Microsoft\PaneTool\PaneTool.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Users\Admin\AppData\Local\Microsoft\PaneTool\KGGouWo.exe
      KGGouWo.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2988
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "iex([Text.Encoding]::Default.GetString([Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Internet Explorer').GetValue($null)))"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1000
        • C:\Windows\SysWOW64\dllhost.exe
          dllhost
          4⤵
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:4364
        • C:\Windows\SysWOW64\dllhost.exe
          dllhost
          4⤵
            PID:2524
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4456,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
      1⤵
        PID:3632

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Discovery

      Query Registry

      2
      T1012

      System Information Discovery

      3
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Resource Development

      Reconnaissance

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\PaneTool\KGGouWo.exe
        Filesize

        98KB

        MD5

        2770fcbc1d50ed765b051fb0affe9249

        SHA1

        2242bb12a364598e32b93cbb54dd3c0c0594894c

        SHA256

        cf366c91bd917fe5dbcea610fb8506b657bfebbdc5c74eb99ba8ee0cf458def2

        SHA512

        206ad4d97b81ae10eb711622ae6a5dd4039a59b8498e4be281de207b27025cbf720503f66a3d97f88230f2085e15e94b863a968ed4a41455955fa26210e5cb1f

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\PaneTool\PaneTool.exe
        Filesize

        288KB

        MD5

        13b4967e75327d14361a84faa3c2316d

        SHA1

        2a5ac66f0ec8ab642d5137b4faed376f2f3c684e

        SHA256

        2e93234d52d1332a3aabde393ec66aa1a357336350563f12f29c4285f9946e59

        SHA512

        fd113eaabd451729e2ab87f6aacbf47bbe196c34847b27d115f0f30dc4533d250890647ec1e71cdde40262364eb09cbdc3abc1d19a77664204fe2dc4c042f979

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_txd50xdz.4xd.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit
      • C:\Users\Admin\AppData\Roaming\Load.exe
        Filesize

        1.2MB

        MD5

        e541172f456ea5acf9ccfd33b4051fc1

        SHA1

        60193ac3cb3f6063cf432776c3d8bd22a549bd49

        SHA256

        3badf2601b723bbf99d19027dc0d8756228be0557f45e9b3e2e48fd211bc3823

        SHA512

        f08cbf9d3658a3aa8e7c8d62e49aed80f8cd280d53e074ccc65314d2c9bf940ea7efa567eefa68d7b9af0eb9d5e0720dc83e3da3cfef112458c199353ccac597

        Download Submit
      • memory/1000-39-0x0000000006300000-0x000000000634C000-memory.dmp
        Filesize

        304KB

        Download
      • memory/1000-42-0x0000000007290000-0x0000000007301000-memory.dmp
        Filesize

        452KB

        Download
      • memory/1000-25-0x0000000005320000-0x0000000005342000-memory.dmp
        Filesize

        136KB

        Download
      • memory/1000-27-0x0000000005C60000-0x0000000005CC6000-memory.dmp
        Filesize

        408KB

        Download
      • memory/1000-26-0x0000000005BF0000-0x0000000005C56000-memory.dmp
        Filesize

        408KB

        Download
      • memory/1000-23-0x00000000029A0000-0x00000000029D6000-memory.dmp
        Filesize

        216KB

        Download
      • memory/1000-37-0x0000000005CD0000-0x0000000006024000-memory.dmp
        Filesize

        3.3MB

        Download
      • memory/1000-38-0x00000000062C0000-0x00000000062DE000-memory.dmp
        Filesize

        120KB

        Download
      • memory/1000-41-0x0000000006800000-0x000000000681A000-memory.dmp
        Filesize

        104KB

        Download
      • memory/1000-40-0x0000000007A10000-0x000000000808A000-memory.dmp
        Filesize

        6.5MB

        Download
      • memory/1000-24-0x0000000005450000-0x0000000005A78000-memory.dmp
        Filesize

        6.2MB

        Download
      • memory/2224-0-0x00000000039A0000-0x00000000039A1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/2524-46-0x0000000000BF0000-0x0000000000C0C000-memory.dmp
        Filesize

        112KB

        Download
      • memory/2524-47-0x0000000000BF0000-0x0000000000C0C000-memory.dmp
        Filesize

        112KB

        Download
      • memory/2524-86-0x0000000000BF0000-0x0000000000C0C000-memory.dmp
        Filesize

        112KB

        Download
      • memory/4364-45-0x0000000000BF0000-0x0000000000C30000-memory.dmp
        Filesize

        256KB

        Download
      • memory/4364-44-0x0000000000BF0000-0x0000000000C30000-memory.dmp
        Filesize

        256KB

        Download
      • memory/4364-43-0x0000000000BF0000-0x0000000000C30000-memory.dmp
        Filesize

        256KB

        Download
      • memory/4364-48-0x0000000000BF0000-0x0000000000C30000-memory.dmp
        Filesize

        256KB

        Download
      • memory/4364-51-0x0000000000BF0000-0x0000000000C30000-memory.dmp
        Filesize

        256KB

        Download
      • memory/4364-52-0x0000000000BF0000-0x0000000000C30000-memory.dmp
        Filesize

        256KB

        Download