56797b3effe1deaaf7025ad8a05460d1b669e34a1d490d6a3f1a988dfb67a8ce

Analysis

max time kernel
160s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29c331ca757557e9bb5f51329bfe702a.exe
Size

1.3MB
MD5

29c331ca757557e9bb5f51329bfe702a
SHA1

c868691ff20e6e5f2c8b1d76bb6ffce23ebe5fe3
SHA256

56797b3effe1deaaf7025ad8a05460d1b669e34a1d490d6a3f1a988dfb67a8ce
SHA512

c7ae70d0b501f314c951fa103ef36dd7a4a0fa357c16229dd6dcb9fcd9217c74923bdd9c0f3c8daeb5a4010fe2e3cb756bcde3f8c84c4a90480bb32508df67bd
SSDEEP

24576:/shlGWT98xprRtjX5zDH3qCrxE387s8OnNDbw/vzDtHkGVv+F0+0n:/shR9qprRtNzD3PtMuh/7JzVH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	29c331ca757557e9bb5f51329bfe702a.exe

Executes dropped EXE 2 IoCs

pid	Process
2632	pinch3(crypted).exe
2872	pinch3(crypted).exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2632 set thread context of 2872	2632	pinch3(crypted).exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 2632	3356	29c331ca757557e9bb5f51329bfe702a.exe	95
PID 3356 wrote to memory of 2632	3356	29c331ca757557e9bb5f51329bfe702a.exe	95
PID 3356 wrote to memory of 2632	3356	29c331ca757557e9bb5f51329bfe702a.exe	95
PID 2632 wrote to memory of 2872	2632	pinch3(crypted).exe	96
PID 2632 wrote to memory of 2872	2632	pinch3(crypted).exe	96
PID 2632 wrote to memory of 2872	2632	pinch3(crypted).exe	96
PID 2632 wrote to memory of 2872	2632	pinch3(crypted).exe	96
PID 2632 wrote to memory of 2872	2632	pinch3(crypted).exe	96
PID 2632 wrote to memory of 2872	2632	pinch3(crypted).exe	96
PID 2632 wrote to memory of 2872	2632	pinch3(crypted).exe	96

C:\Users\Admin\AppData\Local\Temp\29c331ca757557e9bb5f51329bfe702a.exe
"C:\Users\Admin\AppData\Local\Temp\29c331ca757557e9bb5f51329bfe702a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Users\Admin\AppData\Local\Temp\pinch3(crypted).exe
  "C:\Users\Admin\AppData\Local\Temp\pinch3(crypted).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Users\Admin\AppData\Local\Temp\pinch3(crypted).exe
    "C:\Users\Admin\AppData\Local\Temp\pinch3(crypted).exe"
    3⤵
    - Executes dropped EXE
    PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2872 -ip 2872
1⤵
PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pinch3(crypted).exe

Filesize
69KB

MD5
deaaac959f93faaef9d210c9274ffe02

SHA1
ebb050a4937b6396113ff7ea369a67b3b3c89d86

SHA256
658ce2bc209834fb36b29ed996068c34c1aed7757d36cab2b38519ab6030bd2a

SHA512
a63b5c846230bfcfa823647452c80cfe78b1ced6ee0fe160b464989a7ab7dc735c5e309f893fcc86d928c4ada203c6c92f80ea330b8d90775819da31fb1d7f8e

Download Submit
memory/2632-17-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2872-13-0x0000000013140000-0x0000000013183000-memory.dmp

Filesize
268KB

Download
memory/2872-14-0x0000000013140000-0x0000000013183000-memory.dmp

Filesize
268KB

Download
memory/3356-0-0x0000000000400000-0x0000000000549980-memory.dmp

Filesize
1.3MB

Download
memory/3356-1-0x0000000000400000-0x0000000000549980-memory.dmp

Filesize
1.3MB

Download