2d7b1d385d39ef9529f8dce7d72d4002cc944639836efd1308772a8a002d5f91

Analysis

max time kernel
143s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ha_Photilla-v1.0/Photilla 1.00/uninst.exe
Size

400KB
MD5

e1aa743888b73afc421eb3d23af05561
SHA1

e68aa8cdba201cdb8b801b041f4083e95d1dab6f
SHA256

b7ba22071f78978b714b196b8cb1bbebfc054a5d3c34836ad61766085ea9955a
SHA512

9e8874b981aa426d69490bdf71e8d14262897f5aabdc36a93b7342d260d9631a31bda501edc0cd178f80c617fa3e04e726c825f2e696bcb84facaf0d1d0f4175
SSDEEP

6144:i+805JE4xkiVexNUwA4IHk6Xa6+wdPzh4cXwee5QWow:i+8uyo9VNH46+RcXeLow

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	uninst.exe

Executes dropped EXE 1 IoCs

pid	Process
2336	uninst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2336	2368	uninst.exe	93
PID 2368 wrote to memory of 2336	2368	uninst.exe	93
PID 2368 wrote to memory of 2336	2368	uninst.exe	93

C:\Users\Admin\AppData\Local\Temp\ha_Photilla-v1.0\Photilla 1.00\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\ha_Photilla-v1.0\Photilla 1.00\uninst.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\uninst.exe
  "C:\Users\Admin\AppData\Local\Temp\uninst.exe" -u
  2⤵
  - Executes dropped EXE
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\uninst.exe

Filesize
400KB

MD5
e1aa743888b73afc421eb3d23af05561

SHA1
e68aa8cdba201cdb8b801b041f4083e95d1dab6f

SHA256
b7ba22071f78978b714b196b8cb1bbebfc054a5d3c34836ad61766085ea9955a

SHA512
9e8874b981aa426d69490bdf71e8d14262897f5aabdc36a93b7342d260d9631a31bda501edc0cd178f80c617fa3e04e726c825f2e696bcb84facaf0d1d0f4175

Download Submit