52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2023 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe
Size

3.2MB
MD5

97184243a24e376fbf7aa5a4e1091b9c
SHA1

f957f7799166c2e42e0e6f252162d8d138d3ba5e
SHA256

52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d
SHA512

45c3a3458e5be1fd4d92bfefc516570cfea09310dffca5010e3876f2e06f2b9a69ba8054649a8afd21bb909829dcd90f4e6a3be787a95f46efcb7ced719dc6e3
SSDEEP

49152:dCYeGbfBf2DMDaLu20+xyKrtfH8521coA8Ug8+9jWhqmTvbKixHKZ7eFxC5Sy/3y:YvCRmB0Kco3dDjkqmTu3I4SmVQ

Score

1^/10

Malware Config

Signatures

Modifies Control Panel 3 IoCs

evasion

Processes:

52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\sShortDate = "yyyy-MM-dd"	52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\iDate = "2"	52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\sDate = "-"	52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe

pid	process
2128	52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe
2128	52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe
2128	52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe

description	pid	process	target process
PID 2128 wrote to memory of 2004	2128	52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe	splwow64.exe
PID 2128 wrote to memory of 2004	2128	52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe
"C:\Users\Admin\AppData\Local\Temp\52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe"
1⤵
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Config.ini
Filesize
230B

MD5
6c6c0ab352620fc15e2ad3bbb3c9cfe9

SHA1
94d3f197c9df5d8cf2c3b09bedb122a94adac9d2

SHA256
e577ac3cb2c2022c63fee355691d2910109bc510cf0eaa6b59eb8740bcb6dbb7

SHA512
e67fde1b132c5d0330f023cb364e2e28c9dfa58e76eeea07d24166cc2b8290d32f7729a225dc864e14668544acba7fb97702ca4242904469569d0d1c3395f160

Download Submit
memory/2128-141-0x00000000057C0000-0x00000000057C1000-memory.dmp

Filesize
4KB

Download
memory/2128-142-0x0000000005890000-0x0000000005891000-memory.dmp

Filesize
4KB

Download
memory/2128-136-0x0000000000400000-0x0000000000D43000-memory.dmp

Filesize
9.3MB

Download
memory/2128-137-0x0000000000400000-0x0000000000D43000-memory.dmp

Filesize
9.3MB

Download
memory/2128-138-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Filesize
4KB

Download
memory/2128-139-0x0000000005410000-0x0000000005411000-memory.dmp

Filesize
4KB

Download
memory/2128-135-0x0000000000400000-0x0000000000D43000-memory.dmp

Filesize
9.3MB

Download
memory/2128-133-0x0000000000400000-0x0000000000D43000-memory.dmp

Filesize
9.3MB

Download
memory/2128-140-0x0000000005520000-0x0000000005521000-memory.dmp

Filesize
4KB

Download
memory/2128-144-0x0000000005DE0000-0x0000000005DE1000-memory.dmp

Filesize
4KB

Download
memory/2128-143-0x0000000005C10000-0x0000000005C11000-memory.dmp

Filesize
4KB

Download
memory/2128-145-0x0000000000400000-0x0000000000D43000-memory.dmp

Filesize
9.3MB

Download
memory/2128-134-0x0000000000400000-0x0000000000D43000-memory.dmp

Filesize
9.3MB

Download
memory/2128-162-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Filesize
4KB

Download
memory/2128-161-0x0000000000400000-0x0000000000D43000-memory.dmp

Filesize
9.3MB

Download