579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb

Analysis

max time kernel
136s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe
Size

13.0MB
MD5

4b55cb09a7aaa655bff315854cc1d491
SHA1

26db65eb6b0d6a7ed70fc129f249f2bc18b3ab27
SHA256

579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb
SHA512

c7baf1ce5dcc7ca6dbe80db336f092e2805223db62e7008ad31943aaed63b6e71e1371202d6ed048a8f78b41398367747a0ed2683a22e270967b1e3237f739e8
SSDEEP

393216:sb0zsM3W+TQbcVCuTTEVUiWT1u8F7WDoVeSnk:sb0zPswIxUziDovk

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe

Executes dropped EXE 2 IoCs

pid	Process
748	DataStoreCacheDumpTool&t.exe
3232	DataStoreCacheDumpTool&t.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
748	DataStoreCacheDumpTool&t.exe
3232	DataStoreCacheDumpTool&t.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 748	1428	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	87
PID 1428 wrote to memory of 748	1428	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	87
PID 1428 wrote to memory of 2524	1428	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	89
PID 1428 wrote to memory of 2524	1428	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	89
PID 1428 wrote to memory of 3232	1428	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	90
PID 1428 wrote to memory of 3232	1428	579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe	90

C:\Users\Admin\AppData\Local\Temp\579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe
"C:\Users\Admin\AppData\Local\Temp\579f8367e4c9b719272e632e1ce4fde8fab2294203b82251640406cbb1c8b0bb.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Users\Admin\AppData\Local\Temp\DataStoreCacheDumpTool&t.exe
  "C:\Users\Admin\AppData\Local\Temp\DataStoreCacheDumpTool&t.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:748
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FIash-setup.VBS"
  2⤵
  PID:2524
- C:\Users\Admin\AppData\Local\Temp\DataStoreCacheDumpTool&t.exe
  "C:\Users\Admin\AppData\Local\Temp\DataStoreCacheDumpTool&t.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DataStoreCacheDumpTool&t.exe

Filesize
273KB

MD5
f9ab2f60d7acd5d8bd9866697c95f4c6

SHA1
e7fe2624965504ca6f531fe189e1f070ac59e24a

SHA256
57e07e068392053f9e00b28dad2127e381c7c51fa593faecc2ebc3a05a5b01b0

SHA512
a256b92339e2a774e05a6ecbe62d3d78879fbc2a4f0b26a5a3f07fc031c0578a9adc351f0a245a74479ffd197efd6873373376fbe624dfba876236d8cf663808

Download Submit
C:\Users\Admin\AppData\Local\Temp\FIash-setup.VBS

Filesize
66B

MD5
3475bd06427e0bb1557816db74e90dd8

SHA1
213c05319f7291ca527b8f0b8670917d1d4c6b65

SHA256
3e45bf737861c65af59db82ad70c13c795c5309a134fdac0717cae5ad69eacf0

SHA512
54af790db479bc55fb23f46bd4584cce04c8b5e6ae397fffd8a4d958e951ebf8ac2535b8ab3189da6c6d3c2efe11c84d78d26a9b7ec0469be1647074d024e922

Download Submit
memory/748-20-0x0000000002EF0000-0x0000000002EF2000-memory.dmp

Filesize
8KB

Download