477f2355a728cecfcbb21dcdc3da50a1b2145e27a8ba136a43b57810670f6881

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07b12079a308905769e9b1078650d5e6.exe
Size

890KB
MD5

07b12079a308905769e9b1078650d5e6
SHA1

401306407e151f3ec203d58f209ca41940d9793e
SHA256

477f2355a728cecfcbb21dcdc3da50a1b2145e27a8ba136a43b57810670f6881
SHA512

5123b52831502d906153fb52f4684c5976b9caa7157b872dd8f91abf991f8d9843ac5737ec24da895f6f98e5778008f6ceaad49785e4a9974665dd8d9174ffc7
SSDEEP

24576:WHLmCiIh+yWCtgGMORpJZB292z63rqPAf:7UHMORpJZQ964qPAf

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	07b12079a308905769e9b1078650d5e6.exe

Executes dropped EXE 2 IoCs

pid	Process
4276	Whitelist.exe
1444	Skisploit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4276	Whitelist.exe
1444	Skisploit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4276	Whitelist.exe
Token: SeDebugPrivilege	1444	Skisploit.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 4276	4228	07b12079a308905769e9b1078650d5e6.exe	26
PID 4228 wrote to memory of 4276	4228	07b12079a308905769e9b1078650d5e6.exe	26
PID 4228 wrote to memory of 4276	4228	07b12079a308905769e9b1078650d5e6.exe	26
PID 4228 wrote to memory of 1444	4228	07b12079a308905769e9b1078650d5e6.exe	25
PID 4228 wrote to memory of 1444	4228	07b12079a308905769e9b1078650d5e6.exe	25
PID 4228 wrote to memory of 1444	4228	07b12079a308905769e9b1078650d5e6.exe	25

C:\Users\Admin\AppData\Local\Temp\07b12079a308905769e9b1078650d5e6.exe
"C:\Users\Admin\AppData\Local\Temp\07b12079a308905769e9b1078650d5e6.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\Skisploit.exe
  "C:\Users\Admin\AppData\Local\Temp\Skisploit.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1444
- C:\Users\Admin\AppData\Local\Temp\Whitelist.exe
  "C:\Users\Admin\AppData\Local\Temp\Whitelist.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Whitelist.exe

Filesize
4KB

MD5
cc7615951b58dbb923570afe6c45fab3

SHA1
6ea52c8379ad45379476de22e98d9a9917546d23

SHA256
0a3c4691f6f066fd2309dd38c0b5b4d27d0523d7ae42b34a3dfcfcca8666f437

SHA512
5c1c492a869ee07079cfd8cbb8411b1020a8245951619074ac6f87f704c56b50a294832f5889bdae71661836246c836f637af002d6fa7a8607176a04a6a53b01

Download Submit
memory/1444-30-0x0000000076FB2000-0x0000000076FB3000-memory.dmp

Filesize
4KB

Download
memory/1444-26-0x00000000007B0000-0x00000000007B5000-memory.dmp

Filesize
20KB

Download
memory/1444-43-0x00000000725F0000-0x0000000072DA0000-memory.dmp

Filesize
7.7MB

Download
memory/1444-35-0x00000000725F0000-0x0000000072DA0000-memory.dmp

Filesize
7.7MB

Download
memory/1444-31-0x0000000076FB3000-0x0000000076FB4000-memory.dmp

Filesize
4KB

Download
memory/1444-37-0x00000000050F0000-0x0000000005100000-memory.dmp

Filesize
64KB

Download
memory/1444-33-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1444-25-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4276-36-0x00000000054B0000-0x00000000054C0000-memory.dmp

Filesize
64KB

Download
memory/4276-29-0x0000000076FB3000-0x0000000076FB4000-memory.dmp

Filesize
4KB

Download
memory/4276-27-0x0000000076FB2000-0x0000000076FB3000-memory.dmp

Filesize
4KB

Download
memory/4276-40-0x00000000725F0000-0x0000000072DA0000-memory.dmp

Filesize
7.7MB

Download
memory/4276-34-0x00000000725F0000-0x0000000072DA0000-memory.dmp

Filesize
7.7MB

Download
memory/4276-15-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4276-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download