89b94026628101352b40cda21b9988c70a5a139b23d6936416635bcdde3d211a

Analysis

max time kernel
142s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

52f30521af2bfae6abedcbc5f7d701fc.exe
Size

56KB
MD5

52f30521af2bfae6abedcbc5f7d701fc
SHA1

9c7fb09ec96432fce6aacdfa86e99b6e72608bc2
SHA256

89b94026628101352b40cda21b9988c70a5a139b23d6936416635bcdde3d211a
SHA512

916b1dde79eae2ce430df13ebccdd72500fb9512b1518d2aff0bf5abc05c97673b626501398b7c387ecc595324bb7f479cd35e73df3528ada4b4d548d9d54ad9
SSDEEP

1536:nn/oYXOXkUp87fsDyloLpoWUEuN2Sql8:n/oo7EBpo1EuN88

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	52f30521af2bfae6abedcbc5f7d701fc.exe

Executes dropped EXE 1 IoCs

pid	Process
4524	SMSS.EXE

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\Tasks\SMSS.EXE	52f30521af2bfae6abedcbc5f7d701fc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4952	52f30521af2bfae6abedcbc5f7d701fc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4524	4952	52f30521af2bfae6abedcbc5f7d701fc.exe	87
PID 4952 wrote to memory of 4524	4952	52f30521af2bfae6abedcbc5f7d701fc.exe	87
PID 4952 wrote to memory of 4524	4952	52f30521af2bfae6abedcbc5f7d701fc.exe	87

C:\Users\Admin\AppData\Local\Temp\52f30521af2bfae6abedcbc5f7d701fc.exe
"C:\Users\Admin\AppData\Local\Temp\52f30521af2bfae6abedcbc5f7d701fc.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4952
- C:\WINDOWS\Tasks\SMSS.EXE
  "C:\WINDOWS\Tasks\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Tasks\SMSS.EXE

Filesize
13KB

MD5
c5957b883b32ccdd4421af38436704cb

SHA1
331009a0b9f71638634a3232f7f7c653811a1646

SHA256
a0517cd1dc714ec9c34263e68e11336aeff6b4c8ebbcca13e955107f052b5d92

SHA512
cc210f48f5b52cd76cfc967cc5ae22dab288ada4c88c6d9ed3f56bca58b9219b83fc6bd425343d37a67eb6a6327a9cb2b0488d9e4a77ca78c7018cc1028c0c94

Download Submit
memory/4952-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4952-8-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download