48c616cbb15b33f9f8001ae8074e8f68657f604bb20b923ddb6722f752427a9e

Analysis

max time kernel
31s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-08-2024 06:51

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

$TEMP/GooglePinyinDownloader.exe
Size

77KB
MD5

1465ec3df8e8ab31f89fa32bcfaf07da
SHA1

73a36f944fbe18a2b3308e790e1948db8a811ce1
SHA256

e3c8772f34c183545cd6d643e8c1b28aeea0abdfb4ebd02b167363fb31195106
SHA512

911276cbad2f32acd34af6c71e1cbd7c6204a4f0aad93a30fb1104d82469e620de878f292ffc406a8e8f8ce05dfe315e496844e8720b3cd74762163f6d7eb25d
SSDEEP

1536:afppeVwsNT+W7Nv1KDMQ0jwg+rZGjvBtulY3ha:a+XwghQBNIZtulYk

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	GooglePinyinDownloader.exe

Executes dropped EXE 1 IoCs

pid	Process
3416	GooglePinyinInstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GooglePinyinInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GooglePinyinDownloader.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 3416	3044	GooglePinyinDownloader.exe	90
PID 3044 wrote to memory of 3416	3044	GooglePinyinDownloader.exe	90
PID 3044 wrote to memory of 3416	3044	GooglePinyinDownloader.exe	90

C:\Users\Admin\AppData\Local\Temp\$TEMP\GooglePinyinDownloader.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\GooglePinyinDownloader.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\GPY7DEA.tmp\GooglePinyinInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\GPY7DEA.tmp\GooglePinyinInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GPY7DEA.tmp\GooglePinyinInstaller.exe

Filesize
11.5MB

MD5
50cf3f4ed3126a199d076642a87fba62

SHA1
bdd8692bb9feeb95027f0d8cf7d327c5cafac6a0

SHA256
9208f88499d650854f1c3392d8e5e71e139ef93e99e1013c37753690a78fae2a

SHA512
e5e83fdb1c3ac9e30f008a1490c6d857ed82d3f56a667deb61cdb96e6d53155a345db031b63cf10666b4644b2bcb032c332b8adbf357088cef1e94db4f63e9d7

Download Submit