Analysis
-
max time kernel
124s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
27/11/2023, 20:24
General
-
Target
25.11.2023_154212.jpg.scr
-
Size
643.0MB
-
MD5
a00113d3e9dedf86309c22b1b7309fdc
-
SHA1
2a61f0a72e7833d3385cf98c5fb876e2b7de3466
-
SHA256
e141c2a0666e1f8471bb3b97d99f96ffcaf1ceab7964700239aacfedb90412e9
-
SHA512
98796f680bb4156982cf68a98000bedbc23a444b54f367303b547cff9e4ade946eb9d28f882d6db76cbeebb1e0f3d02aa07dec63c9d96d28baae429a4a77792d
-
SSDEEP
49152:4JM8HnE4zw7vtvw2DnXSGLZDRSh0zd+huOV0J3xoX7ixWD1/:4Jpzw7vdRDRd4u7oyWD1/
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\25.11.2023_154212.jpg.scr"C:\Users\Admin\AppData\Local\Temp\25.11.2023_154212.jpg.scr" /S1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\25.11.2023_154212.jpg.scr" & del "C:\ProgramData\*.dll"" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
512KB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
972KB
-
Filesize
16.0MB
-
Filesize
512KB