f5a08f73ef4af60d8f89e5c5aa23cbcd112422868c311ffbfc18285510dd8079

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
08/12/2023, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 3.2MB
Sample231208-b9tnmsgf34
SHA256 f5a08f73ef4af60d8f89e5c5aa23cbcd112422868c311ffbfc18285510dd8079
MD5 4b1b489e8c63881db94bf759a6a1f32f
SHA1 25835117d0609881014ac5b9204b2ef636a3de60
SHA512 453cfe8321b6ae50f6eadaeaf77d380ba8ae7309849301b4efc5087fe7bfd85a3f8f05fb9d6b8683321ac854d6e5bb6aa31d7798f79cb15a86fb43b23c96e216
SSDEEP 98304:W9yTCqoAlUpvyi1axWS6Wnwz96yKLHgpl/H0fy8Lt1a:W9VqobyaaxWS6Iwz99KilT41a
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000\Control Panel\International\Geo\Nation	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1212	rundll32.exe
4324	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 4424	3016	file.exe	87
PID 3016 wrote to memory of 4424	3016	file.exe	87
PID 3016 wrote to memory of 4424	3016	file.exe	87
PID 4424 wrote to memory of 620	4424	cmd.exe	91
PID 4424 wrote to memory of 620	4424	cmd.exe	91
PID 4424 wrote to memory of 620	4424	cmd.exe	91
PID 620 wrote to memory of 1212	620	control.exe	94
PID 620 wrote to memory of 1212	620	control.exe	94
PID 620 wrote to memory of 1212	620	control.exe	94
PID 1212 wrote to memory of 1628	1212	rundll32.exe	105
PID 1212 wrote to memory of 1628	1212	rundll32.exe	105
PID 1628 wrote to memory of 4324	1628	RunDll32.exe	106
PID 1628 wrote to memory of 4324	1628	RunDll32.exe	106
PID 1628 wrote to memory of 4324	1628	RunDll32.exe	106

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c .\rWva.cmD
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\7zS8CBF8F77\3NI.cPl",
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:620
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS8CBF8F77\3NI.cPl",
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1212
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS8CBF8F77\3NI.cPl",
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1628
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7zS8CBF8F77\3NI.cPl",
        6⤵
        Loads dropped DLL
        
        PID:4324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3NI.cPl

Path C:\Users\Admin\AppData\Local\Temp\7zS8CBF8F77\3NI.cPl
Size 4.1MB
SHA256 912772bac51f50b847e5471a4c7fb43ecda6c952074ece990397f94e6cfc5ad1
MD5 b16ebbedbbaf695aaaeb1a67011e0229
SHA1 e8f01f04325c159345032e5e6123a8e9cbabdea5
SHA512 a647e2273f91c6ccb6ee267f067f23c259ca689ee98923c2a3556fdad5d96525bbcd7e3e5e087547b57c96824272aa48dbe5bde30469764979de994d008f6a08
SSDEEP 98304:dxJvqgAloiEJibajpSBYxhjZMLa0OmCtbH0fy8/j9:RqgRJgajpSBYxZZsgPt/u9
MD5 SHA1 SHA512 SSDEEP

Submit Download

3NI.cPl

Path C:\Users\Admin\AppData\Local\Temp\7zS8CBF8F77\3NI.cPl
Size 4.1MB
SHA256 912772bac51f50b847e5471a4c7fb43ecda6c952074ece990397f94e6cfc5ad1
MD5 b16ebbedbbaf695aaaeb1a67011e0229
SHA1 e8f01f04325c159345032e5e6123a8e9cbabdea5
SHA512 a647e2273f91c6ccb6ee267f067f23c259ca689ee98923c2a3556fdad5d96525bbcd7e3e5e087547b57c96824272aa48dbe5bde30469764979de994d008f6a08
SSDEEP 98304:dxJvqgAloiEJibajpSBYxhjZMLa0OmCtbH0fy8/j9:RqgRJgajpSBYxZZsgPt/u9
MD5 SHA1 SHA512 SSDEEP

Submit Download

3NI.cPl

Path C:\Users\Admin\AppData\Local\Temp\7zS8CBF8F77\3NI.cPl
Size 4.1MB
SHA256 912772bac51f50b847e5471a4c7fb43ecda6c952074ece990397f94e6cfc5ad1
MD5 b16ebbedbbaf695aaaeb1a67011e0229
SHA1 e8f01f04325c159345032e5e6123a8e9cbabdea5
SHA512 a647e2273f91c6ccb6ee267f067f23c259ca689ee98923c2a3556fdad5d96525bbcd7e3e5e087547b57c96824272aa48dbe5bde30469764979de994d008f6a08
SSDEEP 98304:dxJvqgAloiEJibajpSBYxhjZMLa0OmCtbH0fy8/j9:RqgRJgajpSBYxZZsgPt/u9
MD5 SHA1 SHA512 SSDEEP

Submit Download

rWvA.CMd

Path C:\Users\Admin\AppData\Local\Temp\7zS8CBF8F77\rWvA.CMd
Size 71B
SHA256 b70a6e4aed20d756cdfd3bea87cd0fe0b7445c8d832bfb8160e391bffa43cbf1
MD5 2c3df40a53698cc564052a8d12236b92
SHA1 253f4d53e6d552a97cf9c0389b3eb554b6943ddf
SHA512 839157f9738b95ceabedf906fcf3ac2812398b7b94fbaaea21983e4ed82adde33214703efc023f3e336e89a16898342b0f651fccc30732765ae0f23c3a3fc080
MD5 SHA1 SHA512

Submit Download

memory/1212-23-0x00000000041E0000-0x00000000042E3000-memory.dmp

Download

memory/1212-52-0x00000000041E0000-0x00000000042E3000-memory.dmp

Download

memory/1212-12-0x0000000002C50000-0x0000000002D67000-memory.dmp

Download

memory/1212-15-0x0000000002C50000-0x0000000002D67000-memory.dmp

Download

memory/1212-16-0x0000000010000000-0x0000000010419000-memory.dmp

Download

memory/1212-20-0x0000000002C50000-0x0000000002D67000-memory.dmp

Download

memory/1212-21-0x0000000002D70000-0x00000000040C1000-memory.dmp

Download

memory/1212-22-0x00000000040D0000-0x00000000041D4000-memory.dmp

Download

memory/1212-9-0x0000000010000000-0x0000000010419000-memory.dmp

Download

memory/1212-24-0x00000000041E0000-0x00000000042E3000-memory.dmp

Download

memory/1212-8-0x0000000000800000-0x0000000000806000-memory.dmp

Download

memory/1212-11-0x0000000002B10000-0x0000000002C43000-memory.dmp

Download

memory/1212-53-0x00000000002B0000-0x00000000002C2000-memory.dmp

Download

memory/4324-27-0x00000000026F0000-0x00000000026F6000-memory.dmp

Download

memory/4324-34-0x0000000003150000-0x0000000003267000-memory.dmp

Download

memory/4324-38-0x0000000003150000-0x0000000003267000-memory.dmp

Download

memory/4324-40-0x00000000045D0000-0x00000000046D4000-memory.dmp

Download

memory/4324-42-0x00000000046E0000-0x00000000047E3000-memory.dmp

Download

memory/4324-44-0x00000000046E0000-0x00000000047E3000-memory.dmp

Download

memory/4324-45-0x0000000000910000-0x0000000000922000-memory.dmp

Download

memory/4324-46-0x00000000456C0000-0x0000000045713000-memory.dmp

Download

memory/4324-31-0x0000000003150000-0x0000000003267000-memory.dmp

Download

memory/4324-30-0x0000000003010000-0x0000000003143000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads