cd8bfc79a21655ac653c24dcd3960bd113f99091504ac486007b3cb28ac69df4

Analysis

max time kernel
164s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DWM7.exe
Size

816KB
MD5

a68f9d828dd808c7fc9b3dfc7d313ef0
SHA1

8b3a60f2329d159a06ee8b4feb704494dfc91825
SHA256

cd8bfc79a21655ac653c24dcd3960bd113f99091504ac486007b3cb28ac69df4
SHA512

5567cae4137794874c0f48c0dbcbc9aaa9757e800aa8435833255f703e0a731747b91b91326a84cc4542f421b7e06b36af214b9fbf2e46b3eeeeef0128be4296
SSDEEP

24576:oEnu1l+HdsAMaXt6uC56GoZTQZzCfFQ3C:oEnaJAMahCJoZMZzWFQ3C

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3724	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 3724	4196	DWM7.exe	88
PID 4196 wrote to memory of 3724	4196	DWM7.exe	88

C:\Users\Admin\AppData\Local\Temp\DWM7.exe
"C:\Users\Admin\AppData\Local\Temp\DWM7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c embedded.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  PID:3724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4196-0-0x00007FF63CFD0000-0x00007FF63D078000-memory.dmp

Filesize
672KB

Download