Overview
overview
7Static
static
3App/AppInf...on.ico
windows7-x64
3App/AppInf...on.ico
windows10-2004-x64
3App/AppInf...fo.ini
windows7-x64
1App/AppInf...fo.ini
windows10-2004-x64
1App/Progra...ro.exe
windows7-x64
3App/Progra...ro.exe
windows10-2004-x64
7App/Progra...an.adm
windows7-x64
3App/Progra...an.adm
windows10-2004-x64
3App/Progra...p2.dll
windows7-x64
3App/Progra...p2.dll
windows10-2004-x64
3App/Progra...e6.dll
windows7-x64
1App/Progra...e6.dll
windows10-2004-x64
1App/Progra...nv.dll
windows7-x64
1App/Progra...nv.dll
windows10-2004-x64
3App/Progra...tl.dll
windows7-x64
1App/Progra...tl.dll
windows10-2004-x64
1App/Progra...-2.dll
windows7-x64
1App/Progra...-2.dll
windows10-2004-x64
3App/Progra...-3.dll
windows7-x64
3App/Progra...-3.dll
windows10-2004-x64
3App/Progra...-1.dll
windows7-x64
3App/Progra...-1.dll
windows10-2004-x64
3App/Progra...-1.dll
windows7-x64
1App/Progra...-1.dll
windows10-2004-x64
3App/Progra...-0.dll
windows7-x64
1App/Progra...-0.dll
windows10-2004-x64
1App/Progra...-0.dll
windows7-x64
3App/Progra...-0.dll
windows10-2004-x64
3App/Progra...-0.dll
windows7-x64
3App/Progra...-0.dll
windows10-2004-x64
3App/Progra...-0.dll
windows7-x64
1App/Progra...-0.dll
windows10-2004-x64
3Analysis
-
max time kernel
94s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14/07/2024, 13:40
Static task
static1
Behavioral task
behavioral1
Sample
App/AppInfo/appicon.ico
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
App/AppInfo/appicon.ico
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
App/AppInfo/appinfo.ini
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
App/AppInfo/appinfo.ini
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
App/ProgramFiles/SimpleMindPro.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
App/ProgramFiles/SimpleMindPro.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
App/ProgramFiles/american.adm
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
App/ProgramFiles/american.adm
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
App/ProgramFiles/bzip2.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
App/ProgramFiles/bzip2.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
App/ProgramFiles/freetype6.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
App/ProgramFiles/freetype6.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
App/ProgramFiles/iconv.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
App/ProgramFiles/iconv.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
App/ProgramFiles/intl.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
App/ProgramFiles/intl.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
App/ProgramFiles/libcairo-2.dll
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
App/ProgramFiles/libcairo-2.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
App/ProgramFiles/libcroco-0.6-3.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
App/ProgramFiles/libcroco-0.6-3.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
App/ProgramFiles/libexpat-1.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
App/ProgramFiles/libexpat-1.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
App/ProgramFiles/libfontconfig-1.dll
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
App/ProgramFiles/libfontconfig-1.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
App/ProgramFiles/libgdk_pixbuf-2.0-0.dll
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
App/ProgramFiles/libgdk_pixbuf-2.0-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
App/ProgramFiles/libgio-2.0-0.dll
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
App/ProgramFiles/libgio-2.0-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
App/ProgramFiles/libglib-2.0-0.dll
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
App/ProgramFiles/libglib-2.0-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
App/ProgramFiles/libgmodule-2.0-0.dll
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
App/ProgramFiles/libgmodule-2.0-0.dll
Resource
win10v2004-20240709-en
General
-
Target
App/ProgramFiles/SimpleMindPro.exe
-
Size
13.8MB
-
MD5
582c4a79213effec901bd4d61576c57a
-
SHA1
83924f0fd7331e68584b3cb1ec3436af8debe96f
-
SHA256
c1a97007ab98bf2bcdaf710a9c1050fcba6309f17a34eb172e74b5654d9943ce
-
SHA512
121b93a00f19d26c9d79b8b813da3cd9986156e4dab58d22a8d8ecdd4eebd9c7caa970d09f923360922fcd912d3c3ee19174d158ecae61af76b3d3d95abae137
-
SSDEEP
98304:UmzCmXIdYtIj/jWxRpCcvUnE71W3rWF1BKTFjsSEXQ7Ol7QDmcXeQwW4p6D/qdwX:LXXe0OcvUnE71WqMZsSUQsceQ/4o/q+
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation SimpleMindPro.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 948 SimpleMindPro.exe 1700 SimpleMindPro.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 948 wrote to memory of 1700 948 SimpleMindPro.exe 85 PID 948 wrote to memory of 1700 948 SimpleMindPro.exe 85 PID 948 wrote to memory of 1700 948 SimpleMindPro.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\App\ProgramFiles\SimpleMindPro.exe"C:\Users\Admin\AppData\Local\Temp\App\ProgramFiles\SimpleMindPro.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\App\ProgramFiles\SimpleMindPro.exe"C:\Users\Admin\AppData\Local\Temp\App\ProgramFiles\SimpleMindPro.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:1700
-