7b19f2e5058a1189c2c887ecbc8a67213154ea99342fffc8a9e150ca092b357a

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2024 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5245ef55647acdacb5058b9f648bf090.exe
Size

753KB
MD5

5245ef55647acdacb5058b9f648bf090
SHA1

a352578568687f68346c3eddfe511a761dd0c1b6
SHA256

7b19f2e5058a1189c2c887ecbc8a67213154ea99342fffc8a9e150ca092b357a
SHA512

26cc7690b1ba8b7e1873e30d87ea3684d2e47bf5f4193f7beb2375c758a15a4125dba112a8ddd0dbae9b0d7bee18ab607bbeee7e5a57e38f297ee45ded859054
SSDEEP

12288:8d923j5J77tjg9wnjVls2+cm1b4eQBRmbxbMk:8d923jP7Z9Va2Hm1b4eQrAMk

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	5245ef55647acdacb5058b9f648bf090.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	5245ef55647acdacb5058b9f648bf090.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1124	5245ef55647acdacb5058b9f648bf090.exe

C:\Users\Admin\AppData\Local\Temp\5245ef55647acdacb5058b9f648bf090.exe
"C:\Users\Admin\AppData\Local\Temp\5245ef55647acdacb5058b9f648bf090.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\7z.exe

Filesize
298B

MD5
f2a6569d57e8f5fe47ed958f186ce8f8

SHA1
2c85586e95f67d825d4b6ccca248cf993a85f58a

SHA256
6536a67ff21f0f67c2edf0ab48f73afa5d5b07b870e67fef89b15fcf2e17ca45

SHA512
c0fc8ee9d56faf5a2bae4f68160b8484b9b86816e53c175e8072d61b4d16403f829d5b36e0455002273f80c83e230b5811ec81a15377ef776cb2f8e72d79decd

Download Submit
C:\Users\Public\Documents\jdi.lnk

Filesize
1KB

MD5
71039ad69e86ef368d6c27658d1fabc0

SHA1
bfa6833a1a0f4e4140d201d110a8f7737e85c701

SHA256
5e8c5c3c4bc9084cfcdd07baa073d801bdca07c27a6002635f60dd2b079f8f05

SHA512
4109bdf099c9d95da18942b5e00f4b9ac12bc0ea428827c9711e4ab48cbddc9aeb34c8b0deb05bb7da749efbd7d50784eef75eaefe0d13f29c672bf0063a66e6

Download Submit