Analysis

  • max time kernel
    94s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/07/2024, 13:40

General

  • Target

    App/ProgramFiles/SimpleMindPro.exe

  • Size

    13.8MB

  • MD5

    582c4a79213effec901bd4d61576c57a

  • SHA1

    83924f0fd7331e68584b3cb1ec3436af8debe96f

  • SHA256

    c1a97007ab98bf2bcdaf710a9c1050fcba6309f17a34eb172e74b5654d9943ce

  • SHA512

    121b93a00f19d26c9d79b8b813da3cd9986156e4dab58d22a8d8ecdd4eebd9c7caa970d09f923360922fcd912d3c3ee19174d158ecae61af76b3d3d95abae137

  • SSDEEP

    98304:UmzCmXIdYtIj/jWxRpCcvUnE71W3rWF1BKTFjsSEXQ7Ol7QDmcXeQwW4p6D/qdwX:LXXe0OcvUnE71WqMZsSUQsceQ/4o/q+

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\App\ProgramFiles\SimpleMindPro.exe
    "C:\Users\Admin\AppData\Local\Temp\App\ProgramFiles\SimpleMindPro.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:948
    • C:\Users\Admin\AppData\Local\Temp\App\ProgramFiles\SimpleMindPro.exe
      "C:\Users\Admin\AppData\Local\Temp\App\ProgramFiles\SimpleMindPro.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/948-0-0x0000000001380000-0x00000000013B8000-memory.dmp

    Filesize

    224KB

  • memory/948-1-0x0000000001580000-0x0000000001581000-memory.dmp

    Filesize

    4KB

  • memory/948-12-0x0000000063A40000-0x0000000063A88000-memory.dmp

    Filesize

    288KB

  • memory/948-26-0x0000000067140000-0x0000000067156000-memory.dmp

    Filesize

    88KB

  • memory/948-27-0x0000000068080000-0x0000000068174000-memory.dmp

    Filesize

    976KB

  • memory/948-25-0x000000006D580000-0x000000006D64C000-memory.dmp

    Filesize

    816KB

  • memory/948-3-0x0000000000400000-0x00000000011EE000-memory.dmp

    Filesize

    13.9MB

  • memory/948-24-0x0000000068F00000-0x0000000068F31000-memory.dmp

    Filesize

    196KB

  • memory/948-23-0x0000000065340000-0x0000000065376000-memory.dmp

    Filesize

    216KB

  • memory/948-22-0x0000000066440000-0x0000000066475000-memory.dmp

    Filesize

    212KB

  • memory/948-21-0x0000000001380000-0x00000000013B8000-memory.dmp

    Filesize

    224KB

  • memory/948-20-0x000000006A300000-0x000000006A323000-memory.dmp

    Filesize

    140KB

  • memory/948-19-0x0000000065C40000-0x0000000065C4E000-memory.dmp

    Filesize

    56KB

  • memory/948-18-0x0000000061A00000-0x0000000061A3C000-memory.dmp

    Filesize

    240KB

  • memory/948-17-0x0000000062E80000-0x0000000062E9F000-memory.dmp

    Filesize

    124KB

  • memory/948-16-0x0000000068F40000-0x0000000068F63000-memory.dmp

    Filesize

    140KB

  • memory/948-15-0x000000006DD00000-0x000000006DD0D000-memory.dmp

    Filesize

    52KB

  • memory/948-14-0x00000000685C0000-0x00000000686C6000-memory.dmp

    Filesize

    1.0MB

  • memory/948-13-0x0000000060900000-0x0000000060992000-memory.dmp

    Filesize

    584KB

  • memory/948-11-0x0000000068DC0000-0x0000000068EAD000-memory.dmp

    Filesize

    948KB

  • memory/948-10-0x000000006A180000-0x000000006A201000-memory.dmp

    Filesize

    516KB

  • memory/948-9-0x0000000064F80000-0x0000000064FC2000-memory.dmp

    Filesize

    264KB

  • memory/948-8-0x000000006D700000-0x000000006D7E3000-memory.dmp

    Filesize

    908KB

  • memory/948-7-0x000000006B280000-0x000000006B296000-memory.dmp

    Filesize

    88KB

  • memory/948-6-0x0000000065580000-0x00000000655C2000-memory.dmp

    Filesize

    264KB

  • memory/948-5-0x000000006D4C0000-0x000000006D4D3000-memory.dmp

    Filesize

    76KB

  • memory/1700-2-0x0000000001690000-0x000000000177D000-memory.dmp

    Filesize

    948KB

  • memory/1700-28-0x0000000003310000-0x0000000003311000-memory.dmp

    Filesize

    4KB

  • memory/1700-44-0x0000000065C40000-0x0000000065C4E000-memory.dmp

    Filesize

    56KB

  • memory/1700-43-0x0000000068F00000-0x0000000068F31000-memory.dmp

    Filesize

    196KB

  • memory/1700-35-0x00000000685C0000-0x00000000686C6000-memory.dmp

    Filesize

    1.0MB

  • memory/1700-34-0x0000000065580000-0x00000000655C2000-memory.dmp

    Filesize

    264KB

  • memory/1700-33-0x0000000063A40000-0x0000000063A88000-memory.dmp

    Filesize

    288KB

  • memory/1700-32-0x0000000060900000-0x0000000060992000-memory.dmp

    Filesize

    584KB

  • memory/1700-31-0x0000000068E40000-0x0000000068E78000-memory.dmp

    Filesize

    224KB

  • memory/1700-30-0x000000006D4C0000-0x000000006D4D3000-memory.dmp

    Filesize

    76KB

  • memory/1700-52-0x0000000001690000-0x000000000177D000-memory.dmp

    Filesize

    948KB

  • memory/1700-51-0x0000000068080000-0x0000000068174000-memory.dmp

    Filesize

    976KB

  • memory/1700-50-0x0000000067140000-0x0000000067156000-memory.dmp

    Filesize

    88KB

  • memory/1700-49-0x0000000061A00000-0x0000000061A3C000-memory.dmp

    Filesize

    240KB

  • memory/1700-48-0x0000000062E80000-0x0000000062E9F000-memory.dmp

    Filesize

    124KB

  • memory/1700-47-0x0000000068F40000-0x0000000068F63000-memory.dmp

    Filesize

    140KB

  • memory/1700-46-0x000000006A300000-0x000000006A323000-memory.dmp

    Filesize

    140KB

  • memory/1700-45-0x000000006DD00000-0x000000006DD0D000-memory.dmp

    Filesize

    52KB

  • memory/1700-42-0x0000000066440000-0x0000000066475000-memory.dmp

    Filesize

    212KB

  • memory/1700-41-0x0000000065340000-0x0000000065376000-memory.dmp

    Filesize

    216KB

  • memory/1700-40-0x000000006D580000-0x000000006D64C000-memory.dmp

    Filesize

    816KB

  • memory/1700-39-0x0000000064F80000-0x0000000064FC2000-memory.dmp

    Filesize

    264KB

  • memory/1700-38-0x000000006A180000-0x000000006A201000-memory.dmp

    Filesize

    516KB

  • memory/1700-37-0x000000006B280000-0x000000006B296000-memory.dmp

    Filesize

    88KB

  • memory/1700-36-0x000000006D700000-0x000000006D7E3000-memory.dmp

    Filesize

    908KB

  • memory/1700-29-0x0000000000400000-0x00000000011EE000-memory.dmp

    Filesize

    13.9MB

  • memory/1700-77-0x0000000003310000-0x0000000003311000-memory.dmp

    Filesize

    4KB