0f81708891d4027ce110f93abece2e5a65239598ab5a551a5f027ab150979209

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd670d26278130392dca9900afade96b.exe
Size

4.5MB
MD5

cd670d26278130392dca9900afade96b
SHA1

39a1762a32ad39f508117f8e3189d1c4302eaa1b
SHA256

0f81708891d4027ce110f93abece2e5a65239598ab5a551a5f027ab150979209
SHA512

3639eeef0da80ddf4b383c2c31941a09e320b544cdb9d47196b6194d4a70ee6ead7e5164b83afe525590411636a680ea1be9d2de98c915888a5a13226cdec2a4
SSDEEP

49152:9dRba8fD8qinfMSKJXIUQREV1QOTu1U5ai2czYo5UC9RhuCTFKlaxV5dgbT7v1iv:K/IJsiCcsop7cTwdzt

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation	cd670d26278130392dca9900afade96b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1084	cd670d26278130392dca9900afade96b.exe

C:\Users\Admin\AppData\Local\Temp\cd670d26278130392dca9900afade96b.exe
"C:\Users\Admin\AppData\Local\Temp\cd670d26278130392dca9900afade96b.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9B2E.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
memory/1084-0-0x000000013F140000-0x000000013F610000-memory.dmp

Filesize
4.8MB

Download
memory/1084-1-0x000000013F140000-0x000000013F610000-memory.dmp

Filesize
4.8MB

Download
memory/1084-120-0x000000013F140000-0x000000013F610000-memory.dmp

Filesize
4.8MB

Download