Analysis
-
max time kernel
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 03:30
Static task
static1
Behavioral task
behavioral1
Sample
26729162a6fd653f36527925d6a82e0d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
26729162a6fd653f36527925d6a82e0d.exe
Resource
win10v2004-20231222-en
General
-
Target
26729162a6fd653f36527925d6a82e0d.exe
-
Size
232KB
-
MD5
26729162a6fd653f36527925d6a82e0d
-
SHA1
c3a1c0a019769fb108386a398b6e7cb704b5568a
-
SHA256
4af602336dd43bdb01d339ad9947973160d5a9834f9187735f0df7bd10a86311
-
SHA512
f488d62d3ddfa808575d85db1fc59fa41cebc21444da3f63988cf520822dd31cad130bb2d3333c4849939a20b777a22672b118342251ab1beb6a14d3f42be7ac
-
SSDEEP
3072:PcVMMF0vWLj88tE/I4iGvKnO/aIsCCKVX89UKOpOhgSbmao5eEPQAwHcTxY0x:E7FWWHtKI4iGvOKaXZLypWzyPQAhTiK
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation 26729162a6fd653f36527925d6a82e0d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\New Windows\Allow 26729162a6fd653f36527925d6a82e0d.exe Set value (data) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.wizpop.co.kr 26729162a6fd653f36527925d6a82e0d.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4484 26729162a6fd653f36527925d6a82e0d.exe 4484 26729162a6fd653f36527925d6a82e0d.exe 4484 26729162a6fd653f36527925d6a82e0d.exe 4484 26729162a6fd653f36527925d6a82e0d.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4484 wrote to memory of 3944 4484 26729162a6fd653f36527925d6a82e0d.exe 29 PID 4484 wrote to memory of 3944 4484 26729162a6fd653f36527925d6a82e0d.exe 29 PID 4484 wrote to memory of 3944 4484 26729162a6fd653f36527925d6a82e0d.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\26729162a6fd653f36527925d6a82e0d.exe"C:\Users\Admin\AppData\Local\Temp\26729162a6fd653f36527925d6a82e0d.exe"1⤵
- Checks computer location settings
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\WizPop\WizPop_Helper.dll"2⤵PID:3944
-