985c6a2f776193878303c9feab070a972358949a5fcf6174ee65ca175e074eb5

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Active_Setup_File/[email protected]
Size

13.0MB
MD5

39039faeece3b3e7584df3948b4c6416
SHA1

004b63add12c9db6a650c3dbc5b29a44378320f2
SHA256

a4a82d859f917b5f915a9c585b975882712eb37b706c8ce93f66536a298d5e8f
SHA512

a626ef5bc541fb9361cd0a505bd3384cc1cc324d30585d9706e3ece7dedab070edc24540ae237cfd020d9091004c835fa5481d4095f4054a1f53936362ed3014
SSDEEP

393216:i3B/08MittPG5fVYji5CwpmwnMQHU1iG5i:i3i8MitpcfVYj0Cof

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2172	7zFM.exe
Token: 35	2172	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 2172	1456	cmd.exe	90
PID 1456 wrote to memory of 2172	1456	cmd.exe	90

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Active_Setup_File\[email protected]
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Active_Setup_File\[email protected]"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads