26a2674c215833b1381bf8471ff298be25064ac96bf7e1d5232441133be89c6e

Analysis

max time kernel
143s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ed6f4456b8540507a386d595167b960.lnk
Size

1KB
MD5

5ed6f4456b8540507a386d595167b960
SHA1

186c32f8e567588486a42b38d2a6f2b0649995b7
SHA256

26a2674c215833b1381bf8471ff298be25064ac96bf7e1d5232441133be89c6e
SHA512

1bd56ff6c7a06caae54deb86438fd02e5b89c73d34d343bb7757a3cb129da2e40384124dda15bd741a95ca6b16592d62045791fa8a55afac9c81a3e9dbbac69f

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 3976	4188	cmd.exe	17
PID 4188 wrote to memory of 3976	4188	cmd.exe	17

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\5ed6f4456b8540507a386d595167b960.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4188
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /c "start %cd%RECYCLER\6dc09d8d.exe &&C:\Windows\explorer.exe %cd%21f741d9b72c54a22d48
  2⤵
  PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...