7cccb41d4fc34b22f10532c31017bbdeaf36f5d5ade80b83d904367f10c6cd4c

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
09/12/2023, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.7MB
Sample231209-hmhfesfbcl
SHA256 7cccb41d4fc34b22f10532c31017bbdeaf36f5d5ade80b83d904367f10c6cd4c
MD5 ac7b63bef9fe0d9402c0062c436e0fba
SHA1 4e4750dd146b5edd31f277f1464f34a756e2be26
SHA512 47153ad9501326cb87abec0e07b995aa702bc689c325d8e60b2cfe06c520b233c5bb1ac60f6e7c2e18d048cd7f167b72cf50fdbc03d9d5cf6c7472f31ad64582
SSDEEP 49152:ISV5KaSkNi3htSkplw2RgAGwVktEKj8w3yaEzONyxEYo9INmgpZtNViZYPXruLcb:IStSK6LSXMvVktNFH+htMINmgNVOYXr1
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Control Panel\International\Geo\Nation	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2860	rundll32.exe
4236	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 4064	1972	file.exe	89
PID 1972 wrote to memory of 4064	1972	file.exe	89
PID 1972 wrote to memory of 4064	1972	file.exe	89
PID 4064 wrote to memory of 4252	4064	cmd.exe	92
PID 4064 wrote to memory of 4252	4064	cmd.exe	92
PID 4064 wrote to memory of 4252	4064	cmd.exe	92
PID 4252 wrote to memory of 2860	4252	control.exe	93
PID 4252 wrote to memory of 2860	4252	control.exe	93
PID 4252 wrote to memory of 2860	4252	control.exe	93
PID 2860 wrote to memory of 4536	2860	rundll32.exe	102
PID 2860 wrote to memory of 4536	2860	rundll32.exe	102
PID 4536 wrote to memory of 4236	4536	RunDll32.exe	103
PID 4536 wrote to memory of 4236	4536	RunDll32.exe	103
PID 4536 wrote to memory of 4236	4536	RunDll32.exe	103

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7z7B9137B4\yPaRdx.Bat" "
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\7z7B9137B4\kLH0gIN.CPl",
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7z7B9137B4\kLH0gIN.CPl",
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2860
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7z7B9137B4\kLH0gIN.CPl",
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4536
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7z7B9137B4\kLH0gIN.CPl",
        6⤵
        Loads dropped DLL
        
        PID:4236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kLH0gIN.CPl

Path C:\Users\Admin\AppData\Local\Temp\7z7B9137B4\kLH0gIN.CPl
Size 3.0MB
SHA256 4b9cd9016d30b69d12522a80a2e6f6b015ca0d68ce8cf960d448aaef6c788b0e
MD5 f16c9a6e20f810880aea3df020d23e74
SHA1 60569e53f364f45c2f4cb9f39ec3cbffe041cd15
SHA512 066ee1c0888fbb1cbfd1187a64d66d6dddc20216f2483065485d9492cf96c8f0fa2655853d0fe35c5c2e337fbad9245aa24272d38f3b3d94e29325ffab2860a1
SSDEEP 49152:Muo5I8UCLH7i3PX2dplL8RWAGyV8tCkjom3iaEaONyx3Y8MkxmgIZQ+8iZDT06MQ:UUy6v2VOdV8tXn3NhoHkxm++8ODTcpov
MD5 SHA1 SHA512 SSDEEP

Submit Download

kLH0gIN.CPl

Path C:\Users\Admin\AppData\Local\Temp\7z7B9137B4\kLH0gIN.CPl
Size 3.0MB
SHA256 4b9cd9016d30b69d12522a80a2e6f6b015ca0d68ce8cf960d448aaef6c788b0e
MD5 f16c9a6e20f810880aea3df020d23e74
SHA1 60569e53f364f45c2f4cb9f39ec3cbffe041cd15
SHA512 066ee1c0888fbb1cbfd1187a64d66d6dddc20216f2483065485d9492cf96c8f0fa2655853d0fe35c5c2e337fbad9245aa24272d38f3b3d94e29325ffab2860a1
SSDEEP 49152:Muo5I8UCLH7i3PX2dplL8RWAGyV8tCkjom3iaEaONyx3Y8MkxmgIZQ+8iZDT06MQ:UUy6v2VOdV8tXn3NhoHkxm++8ODTcpov
MD5 SHA1 SHA512 SSDEEP

Submit Download

kLH0gIN.CPl

Path C:\Users\Admin\AppData\Local\Temp\7z7B9137B4\kLH0gIN.CPl
Size 3.0MB
SHA256 4b9cd9016d30b69d12522a80a2e6f6b015ca0d68ce8cf960d448aaef6c788b0e
MD5 f16c9a6e20f810880aea3df020d23e74
SHA1 60569e53f364f45c2f4cb9f39ec3cbffe041cd15
SHA512 066ee1c0888fbb1cbfd1187a64d66d6dddc20216f2483065485d9492cf96c8f0fa2655853d0fe35c5c2e337fbad9245aa24272d38f3b3d94e29325ffab2860a1
SSDEEP 49152:Muo5I8UCLH7i3PX2dplL8RWAGyV8tCkjom3iaEaONyx3Y8MkxmgIZQ+8iZDT06MQ:UUy6v2VOdV8tXn3NhoHkxm++8ODTcpov
MD5 SHA1 SHA512 SSDEEP

Submit Download

yPaRdx.Bat

Path C:\Users\Admin\AppData\Local\Temp\7z7B9137B4\yPaRdx.Bat
Size 85B
SHA256 f8a413155733d3616e57726d55c0b0963f290d533c07ce045c40840472058804
MD5 e555a2c826aed11619636e44c03cdd81
SHA1 63a409a27fbd6288df28503e32419df716b7907b
SHA512 fb85f1020c5e97fd76cc0173501c4d07bdc594cecbe455aea851778c0e852969acab022e99469f4e921a42bf4d16cebbdb0aaac7682fb7d7e5e63eae596ff128
MD5 SHA1 SHA512

Submit Download

memory/2860-9-0x0000000002DB0000-0x0000000002DB6000-memory.dmp

Download

memory/2860-12-0x0000000003680000-0x00000000037A1000-memory.dmp

Download

memory/2860-13-0x00000000037B0000-0x00000000038B6000-memory.dmp

Download

memory/2860-16-0x00000000037B0000-0x00000000038B6000-memory.dmp

Download

memory/2860-17-0x00000000037B0000-0x00000000038B6000-memory.dmp

Download

memory/2860-10-0x0000000010000000-0x00000000102FE000-memory.dmp

Download

memory/4236-19-0x0000000002650000-0x0000000002656000-memory.dmp

Download

memory/4236-22-0x0000000002DD0000-0x0000000002EF1000-memory.dmp

Download

memory/4236-23-0x0000000002F00000-0x0000000003006000-memory.dmp

Download

memory/4236-26-0x0000000002F00000-0x0000000003006000-memory.dmp

Download

memory/4236-27-0x0000000002F00000-0x0000000003006000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads