1a4ab48b0c383f135de4a04de9d17f8f4443ff66334e94a27de1bdd45a4f8763

Analysis

max time kernel
140s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mphair.exe
Size

1.5MB
MD5

aca60c7c4f24c02f4f48c0be0a5f2ce1
SHA1

289c97a398379b83a45f3800796b1034cbd51791
SHA256

36a004267f8fd8b7f0dc6e4b6f39c95e546e2c2e543813b09f221f87644aec94
SHA512

2663701d739753c2985f9a9557fbaacc98d5ef23c398d66f8d8d92f8085d69a01ed3c5136b4d3059bfb4a6698a4c94d4de89b6ba7b1090ed00dacb522d994410
SSDEEP

49152:XlOAHbVSlb8ixwI6kn9TCubHgWangeE/r2:1OybVJKWiTC2pang

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\msv62.drv	mphair.exe
File opened for modification	C:\Windows\msv62.drv	mphair.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mphair.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\iCurrDigits = "2"	mphair.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\sLongDate = "yyyy-MM-dd"	mphair.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe
1600	mphair.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2256	1600	mphair.exe	86
PID 1600 wrote to memory of 2256	1600	mphair.exe	86

C:\Users\Admin\AppData\Local\Temp\mphair.exe
"C:\Users\Admin\AppData\Local\Temp\mphair.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\msv62.drv

Filesize
6KB

MD5
950153440f32d3bd5ab8bb2a3286d4c7

SHA1
ab5295503647d198d031e041bea88dcd6ec95eec

SHA256
3560b4a19ae5f390d1fa1e338ed8ca2d4ce8f671afb876df4398d21260937567

SHA512
565364337c86d39c44faaad209b022ba8dcee6c9873e8a5ee7c5924226caa46e0a6ddc6fa4b371fa59216f1cba344c997eff5e2c4488ec59819afcc52a094cbf

Download Submit
memory/1600-0-0x0000000000FB0000-0x0000000000FFC000-memory.dmp

Filesize
304KB

Download
memory/1600-1-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/1600-9-0x0000000009EB0000-0x0000000009EB1000-memory.dmp

Filesize
4KB

Download
memory/1600-12-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/1600-11-0x0000000000FB0000-0x0000000000FFC000-memory.dmp

Filesize
304KB

Download
memory/1600-10-0x0000000000400000-0x00000000009F3000-memory.dmp

Filesize
5.9MB

Download
memory/1600-13-0x0000000009EB0000-0x0000000009EB1000-memory.dmp

Filesize
4KB

Download
memory/1600-37-0x0000000000FB0000-0x0000000000FFC000-memory.dmp

Filesize
304KB

Download