541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe
Size

754KB
MD5

cc3dea0182a77c7ca10925e2c180bc62
SHA1

537cd49fa4abf265b69d9d0de982373544c643fc
SHA256

541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b
SHA512

99655f1a80a9aacb5f77917700f4303a53368e62d7807196b6e5fa917a40382523ea9ab42a81ba66d7c2bab12ff291bd2efc0399922ae578f8332e982fda40e0
SSDEEP

12288:K39b2oWvRykNICNEZjwJxtk46A9jmP/uhu/yMS08CkntxYRcBAL:KeNIuEZjqxVfmP/UDMS08Ckn3A

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation cmd.exe
Drops file in Windows directory 1 IoCs

Processes:

mspaint.exe

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

NETSTAT.EXE

pid process

3524 NETSTAT.EXE
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings cmd.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

mspaint.exe

pid process

2528 mspaint.exe
2528 mspaint.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NETSTAT.EXE

description pid process

Token: SeDebugPrivilege 3524 NETSTAT.EXE

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

pid	process
3524	NETSTAT.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe

pid	process
2528	mspaint.exe
2528	mspaint.exe

description	pid	process
Token: SeDebugPrivilege	3524	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exemspaint.exe

pid	process
628	541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe
628	541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe
628	541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe
2528	mspaint.exe
2528	mspaint.exe
2528	mspaint.exe
2528	mspaint.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.execmd.execmd.exe

description	pid	process	target process
PID 628 wrote to memory of 788	628	541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe	cmd.exe
PID 628 wrote to memory of 788	628	541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe	cmd.exe
PID 628 wrote to memory of 788	628	541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe	cmd.exe
PID 788 wrote to memory of 2528	788	cmd.exe	mspaint.exe
PID 788 wrote to memory of 2528	788	cmd.exe	mspaint.exe
PID 788 wrote to memory of 2528	788	cmd.exe	mspaint.exe
PID 3348 wrote to memory of 3524	3348	cmd.exe	NETSTAT.EXE
PID 3348 wrote to memory of 3524	3348	cmd.exe	NETSTAT.EXE

C:\Users\Admin\AppData\Local\Temp\541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe
"C:\Users\Admin\AppData\Local\Temp\541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp
2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\SysWOW64\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp"
3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2528

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:3164

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3348

C:\Windows\system32\NETSTAT.EXE
netstat -na
2⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:3524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3912 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:3252

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads