da8e72fdd273bc745ce6039e0048beb0958dcb60b16fdd979775e4f013325e0f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Splash.PRO.1.3.3_(www.4DOWNLOADS.ir)/Splash.PRO.1.3.3_(www.4DOWNLOADS.ir)/splash_pro_1_3_3_setup.exe
Size

14.0MB
MD5

4fb3413655b5bcf7719e8dfd78dd65c0
SHA1

aedbc3c8eb5039dbab1aa5a7caa88f8e65959cd1
SHA256

b42593751af1d8a3083903d1a2895ec4d415860e606e5bf1ed4eb0dd2dbb6dd3
SHA512

3b05042370c31ef4def7b80a6f2a2576dfc39b9c2eb7f9d0f58bc2a6e03d8664cf5463883b94047f2aa26703e301fbc27a04e86242a874c5b1d645092d262206
SSDEEP

393216:JipWvimXCGrkcZkcZg1GS0p0V+/g/hLhlHiCx6wF8:fmHwZg1x9s/4Fh5Px6wG

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	splash_pro_1_3_3_setup.exe

Executes dropped EXE 1 IoCs

pid	Process
4208	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 4208	900	splash_pro_1_3_3_setup.exe	84
PID 900 wrote to memory of 4208	900	splash_pro_1_3_3_setup.exe	84
PID 900 wrote to memory of 4208	900	splash_pro_1_3_3_setup.exe	84

C:\Users\Admin\AppData\Local\Temp\Splash.PRO.1.3.3_(www.4DOWNLOADS.ir)\Splash.PRO.1.3.3_(www.4DOWNLOADS.ir)\splash_pro_1_3_3_setup.exe
"C:\Users\Admin\AppData\Local\Temp\Splash.PRO.1.3.3_(www.4DOWNLOADS.ir)\Splash.PRO.1.3.3_(www.4DOWNLOADS.ir)\splash_pro_1_3_3_setup.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Local\Temp\Mirillis\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Mirillis\setup.exe"
  2⤵
  - Executes dropped EXE
  PID:4208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Mirillis\setup.exe

Filesize
371KB

MD5
a99078b0977ebe046b88ca712953fb81

SHA1
8ae892a693726947e94e19b165ca174bc46c0fba

SHA256
5adef5463393e54b52aba862cdd30951a40b6f122bc10276abe6a6e63f08577a

SHA512
11b8530394015f34156cbac66459543c7bf08bd269b86c8d0fbdc09aaba278ed3c62ca3b5386f2bb47721ee627f90b858c77c66fbe268e62cf1a407a63b413b7

Download Submit
memory/900-19-0x0000000000400000-0x000000000120E000-memory.dmp

Filesize
14.1MB

Download