Overview

overview

7

Static

static

3

print.exe

windows10-2004-x64

1

printfilte...vc.exe

windows10-2004-x64

1

printui.exe

windows10-2004-x64

1

proquota.exe

windows10-2004-x64

1

provlaunch.exe

windows10-2004-x64

1

provtool.exe

windows10-2004-x64

1

prproc.exe

windows10-2004-x64

1

psr.exe

windows10-2004-x64

1

pwlauncher.exe

windows10-2004-x64

1

rasautou.exe

windows10-2004-x64

1

rasdial.exe

windows10-2004-x64

1

raserver.exe

windows10-2004-x64

1

rasphone.exe

windows10-2004-x64

1

rdpclip.exe

windows10-2004-x64

1

rdpinput.exe

windows10-2004-x64

1

rdrleakdiag.exe

windows10-2004-x64

1

readCloudD...gs.exe

windows10-2004-x64

1

recdisc.exe

windows10-2004-x64

1

recover.exe

windows10-2004-x64

1

refsutil.exe

windows10-2004-x64

1

reg.exe

windows10-2004-x64

1

regedt32.exe

windows10-2004-x64

7

regini.exe

windows10-2004-x64

1

regsvr32.exe

windows10-2004-x64

1

rekeywiz.exe

windows10-2004-x64

1

relog.exe

windows10-2004-x64

1

repair-bde.exe

windows10-2004-x64

1

replace.exe

windows10-2004-x64

1

resmon.exe

windows10-2004-x64

7

rmttpmvscmgrsvr.exe

windows10-2004-x64

1

rrinstaller.exe

windows10-2004-x64

1

rstrui.exe

windows10-2004-x64

1

Resubmissions

09/07/2024, 13:39

240709-qydwdayanf 7

09/07/2024, 07:52

240709-jqdr3swdle 6

09/07/2024, 06:42

240709-hgkzcs1bjl 5

09/07/2024, 06:34

240709-hb2d6azhjn 3

09/07/2024, 05:47

240709-ggxgqa1crh 4

Analysis

  • max time kernel
    150s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240708-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 13:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    resmon.exe

  • Size

    128KB

  • MD5

    f13575a9e5c327a66d2767ee8f051866

  • SHA1

    b7735194fe05f53d58ea4fd56fe4a96fa8fdf247

  • SHA256

    173d896fdee281ebe88eea03d045b1420d0becd9be8049db4d917f2a85c9c836

  • SHA512

    16dda5a048fd86ae81742b51e31d112084514beb85216db9edcfaa1eba803af2ff54a700de1fec7f2b5492e0d1f343cbd445c9c8fb7c7cc39b2008a7b07c275f

  • SSDEEP

    1536:QCFIABqY3KtrtizIo9plJSs9kYuZJnGZLzOcE6Ls7HXG84PK05Z34g/CO+sH:Q0IAghtYIo9piswTogiqQKy349

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\resmon.exe
    "C:\Users\Admin\AppData\Local\Temp\resmon.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3156
    • C:\Windows\System32\perfmon.exe
      "C:\Windows\System32\perfmon.exe" /res
      2⤵
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:4244

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads