fddf222eb86fc770f1f45996cd1a875a87a69c54c3f1760a706f1c70498c93e2

Analysis

max time kernel
0s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e003954447b1fd20f1c8b70843bbf89.exe
Size

1.2MB
MD5

1e003954447b1fd20f1c8b70843bbf89
SHA1

ca976064e4574da2fafa2d18fe9304dd466358b9
SHA256

fddf222eb86fc770f1f45996cd1a875a87a69c54c3f1760a706f1c70498c93e2
SHA512

8cd6626f40e57f453ea1ebacfac36dbae2621ff8db97865b39bf69a5a96190f8eb46f7f04bdbc2a521953484ec8b11a39583a9731b0da750d844dcd0eb102e8e
SSDEEP

24576:z6rTrbp8iVtGVcG9pV1OqVtFnSQT3m6rTtbp8iVtGVcG9pV1OqVtXnSQT0m:zCrbVG9BSIWCtbVG9rSIl

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	1e003954447b1fd20f1c8b70843bbf89.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\1e003954447b1fd20f1c8b70843bbf89.exe
"C:\Users\Admin\AppData\Local\Temp\1e003954447b1fd20f1c8b70843bbf89.exe"
1⤵
- Checks computer location settings
PID:1768
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" "javascript:new ActiveXObject('WScript.Shell').Run('SOLA_2.0_289921666618591.bat',0);window.close()"
  2⤵
  PID:216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SOLA_2.0_289921666618591.bat" "
    3⤵
    PID:4492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c dir C:\Windows\explorer.exe
      4⤵
      PID:4324
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c date /t
      4⤵
      PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SOLA_2.0_289921666618591.bat

Filesize
10KB

MD5
39480d4fcb3e0ec50dcd49b8ba993e1e

SHA1
9b1cc3ba81a705dfd707860e9631e131ce4d7cd0

SHA256
62e390d429f1db85cc0d55944ce2d379a71d5e7e3be0899cc0fc5faad3face21

SHA512
72e07ab09d0508181530a26c4a849dc6337c16ecf9258ba9a0fd091842a36c55babb1e58cbaf296b1370b3cc549fbc338fe7079f462679322346d6e884d720a0

Download Submit
memory/1768-7-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download