5c285ab7d9f7b76c19ab300fa5ac810b623d4b3c1bfd4142e31183e9aab7c467

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2023, 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DLP1.exe
Size

631KB
MD5

b4301236546d79daf3928dcc765d1fea
SHA1

fa51f4d3982eaca2607918cb1bcd0797208a8d5a
SHA256

5c285ab7d9f7b76c19ab300fa5ac810b623d4b3c1bfd4142e31183e9aab7c467
SHA512

93c02cae6d9d14e455eee7024804d02d8ec2d6599ce04e54ebea2911f8e488a242c8cad7f8705967839b4451756479a32c273e4de197026aac6315cca01be880
SSDEEP

12288:1h5XP+Hdsy7MfpE9ftJonSf7azZYGWIT7190d:1/P+HdsAMxE9FRO2GWIT7H0d

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3452	DLP1.exe
3452	DLP1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2844	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 2844	3452	DLP1.exe	87
PID 3452 wrote to memory of 2844	3452	DLP1.exe	87

C:\Users\Admin\AppData\Local\Temp\DLP1.exe
"C:\Users\Admin\AppData\Local\Temp\DLP1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c embedded.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3452-0-0x00007FF7A1BC0000-0x00007FF7A1C44000-memory.dmp

Filesize
528KB

Download