541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe
Size 754KB
Sample240524-smpjvaae89
SHA256 541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b
MD5 cc3dea0182a77c7ca10925e2c180bc62
SHA1 537cd49fa4abf265b69d9d0de982373544c643fc
SHA512 99655f1a80a9aacb5f77917700f4303a53368e62d7807196b6e5fa917a40382523ea9ab42a81ba66d7c2bab12ff291bd2efc0399922ae578f8332e982fda40e0
SSDEEP 12288:K39b2oWvRykNICNEZjwJxtk46A9jmP/uhu/yMS08CkntxYRcBAL:KeNIuEZjqxVfmP/UDMS08Ckn3A
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3524	NETSTAT.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2528	mspaint.exe
2528	mspaint.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3524	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
628	541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe
628	541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe
628	541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe
2528	mspaint.exe
2528	mspaint.exe
2528	mspaint.exe
2528	mspaint.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 788	628	541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe	94
PID 628 wrote to memory of 788	628	541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe	94
PID 628 wrote to memory of 788	628	541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe	94
PID 788 wrote to memory of 2528	788	cmd.exe	98
PID 788 wrote to memory of 2528	788	cmd.exe	98
PID 788 wrote to memory of 2528	788	cmd.exe	98
PID 3348 wrote to memory of 3524	3348	cmd.exe	109
PID 3348 wrote to memory of 3524	3348	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe
"C:\Users\Admin\AppData\Local\Temp\541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp"
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2528

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:3164

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Windows\system32\NETSTAT.EXE
  netstat -na
  2⤵
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:3524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3912 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:3252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads