b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949

Analysis

max time kernel
91s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2023, 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe
Size

1.3MB
MD5

d5b09de35848750c67d3a9001cd4a9c4
SHA1

8162dbeda37f0289c8fcf7dedcdf19acbb38d383
SHA256

b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949
SHA512

df8288d33a2533d0b907c57db331af241cfe27c481dfab69f401060a19c6a9445c2fd505771d8cc0eeecacccec5221e7e81ec3e5fbfeed2cb8d997251ae9afbe
SSDEEP

24576:Vu9BzmQwgESqcSAqIiDMqdEDfQ/TtcQOyqOVVhlT7c8d17UkQ:Vu9BzhwglpSA3JqODfQrkCjc8d17UkQ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4528	b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4528	b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe
4528	b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4528	b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4528	b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe
4528	b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4528	b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe
4528	b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4980	b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe
4528	b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4528	4980	b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe	79
PID 4980 wrote to memory of 4528	4980	b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe	79
PID 4980 wrote to memory of 4528	4980	b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe	79

C:\Users\Admin\AppData\Local\Temp\b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe
"C:\Users\Admin\AppData\Local\Temp\b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Local\Temp\b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe
  "C:\Users\Admin\AppData\Local\Temp\b59c5dab095ab5dff1edabd41af853d2890f347d1d0649f8f30274ed1742e949.exe" - 789CE3E6C60EDC672D286D657AE680439A1B00A2E505B4
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4528-168-0x0000000000400000-0x00000000006E9000-memory.dmp

Filesize
2.9MB

Download
memory/4528-169-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/4528-175-0x0000000000400000-0x00000000006E9000-memory.dmp

Filesize
2.9MB

Download
memory/4528-160-0x0000000002C20000-0x0000000002C8D000-memory.dmp

Filesize
436KB

Download
memory/4528-171-0x00000000046F0000-0x0000000004719000-memory.dmp

Filesize
164KB

Download
memory/4528-153-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/4528-167-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/4528-174-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/4980-134-0x0000000002820000-0x0000000002822000-memory.dmp

Filesize
8KB

Download
memory/4980-133-0x0000000000400000-0x00000000006E9000-memory.dmp

Filesize
2.9MB

Download
memory/4980-151-0x0000000000400000-0x00000000006E9000-memory.dmp

Filesize
2.9MB

Download
memory/4980-150-0x0000000002870000-0x0000000002871000-memory.dmp

Filesize
4KB

Download
memory/4980-143-0x0000000002E20000-0x0000000002E8D000-memory.dmp

Filesize
436KB

Download
memory/4980-136-0x0000000002B90000-0x0000000002C48000-memory.dmp

Filesize
736KB

Download