579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb

Analysis

max time kernel
136s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe
Size 13.0MB
Sample240721-ynbx2asajd
SHA256 579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb
MD5 4b55cb09a7aaa655bff315854cc1d491
SHA1 26db65eb6b0d6a7ed70fc129f249f2bc18b3ab27
SHA512 c7baf1ce5dcc7ca6dbe80db336f092e2805223db62e7008ad31943aaed63b6e71e1371202d6ed048a8f78b41398367747a0ed2683a22e270967b1e3237f739e8
SSDEEP 393216:sb0zsM3W+TQbcVCuTTEVUiWT1u8F7WDoVeSnk:sb0zPswIxUziDovk
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe

Executes dropped EXE 2 IoCs

pid	Process
748	DataStoreCacheDumpTool&t.exe
3232	DataStoreCacheDumpTool&t.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
748	DataStoreCacheDumpTool&t.exe
3232	DataStoreCacheDumpTool&t.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 748	1428	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	87
PID 1428 wrote to memory of 748	1428	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	87
PID 1428 wrote to memory of 2524	1428	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	89
PID 1428 wrote to memory of 2524	1428	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	89
PID 1428 wrote to memory of 3232	1428	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	90
PID 1428 wrote to memory of 3232	1428	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	90

C:\Users\Admin\AppData\Local\Temp\579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe
"C:\Users\Admin\AppData\Local\Temp\579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Users\Admin\AppData\Local\Temp\DataStoreCacheDumpTool&t.exe
  "C:\Users\Admin\AppData\Local\Temp\DataStoreCacheDumpTool&t.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:748
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FIash-setup.VBS"
  2⤵
  PID:2524
- C:\Users\Admin\AppData\Local\Temp\DataStoreCacheDumpTool&t.exe
  "C:\Users\Admin\AppData\Local\Temp\DataStoreCacheDumpTool&t.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DataStoreCacheDumpTool&t.exe

Path C:\Users\Admin\AppData\Local\Temp\DataStoreCacheDumpTool&t.exe
Size 273KB
SHA256 57e07e068392053f9e00b28dad2127e381c7c51fa593faecc2ebc3a05a5b01b0
MD5 f9ab2f60d7acd5d8bd9866697c95f4c6
SHA1 e7fe2624965504ca6f531fe189e1f070ac59e24a
SHA512 a256b92339e2a774e05a6ecbe62d3d78879fbc2a4f0b26a5a3f07fc031c0578a9adc351f0a245a74479ffd197efd6873373376fbe624dfba876236d8cf663808
SSDEEP 6144:pqXJmQs7IQk7EMzvYMvQN25oQp8H4pbJxLEP:0JmQs0R7xzfQAoQp8HOxLEP
MD5 SHA1 SHA512 SSDEEP

Submit Download

FIash-setup.VBS

Path C:\Users\Admin\AppData\Local\Temp\FIash-setup.VBS
Size 66B
SHA256 3e45bf737861c65af59db82ad70c13c795c5309a134fdac0717cae5ad69eacf0
MD5 3475bd06427e0bb1557816db74e90dd8
SHA1 213c05319f7291ca527b8f0b8670917d1d4c6b65
SHA512 54af790db479bc55fb23f46bd4584cce04c8b5e6ae397fffd8a4d958e951ebf8ac2535b8ab3189da6c6d3c2efe11c84d78d26a9b7ec0469be1647074d024e922
MD5 SHA1 SHA512