6a06b2ba1a32b703d65f43d49ddaa8e74d8f5add21a8ab04aa0044937a5a50c5

Analysis

max time kernel
140s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HC2Setup.exe
Size 631KB
Sample240921-knef9stepq
SHA256 6a06b2ba1a32b703d65f43d49ddaa8e74d8f5add21a8ab04aa0044937a5a50c5
MD5 f96a73b23464366e4158620b10fa52c5
SHA1 1b048d127670ea9c113c3582c7d2bfde2bc4b32a
SHA512 2639aa5b6b954d6492fb1116309f0810f68b758717f7b0158107296a515c1b326cdf166590e173a00a92d14dcc80e7aa2e9f4495806890f530b79d17e12ec6b3
SSDEEP 12288:qr3ZBIRB5Ij7QaClHwJFispW/tB7/x+irBvMb4AcKoUvTUfT2uk0pKBLMYN9UUvq:2ZB2B+j+wJF+/H7x+irBuocTvuPpKBAZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	HC2Setup.exe

Executes dropped EXE 1 IoCs

pid	Process
212	HyCam2.exe

Loads dropped DLL 3 IoCs

pid	Process
212	HyCam2.exe
212	HyCam2.exe
212	HyCam2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HC2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HyCam2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
212	HyCam2.exe
212	HyCam2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 212	3688	HC2Setup.exe	89
PID 3688 wrote to memory of 212	3688	HC2Setup.exe	89
PID 3688 wrote to memory of 212	3688	HC2Setup.exe	89

C:\Users\Admin\AppData\Local\Temp\HC2Setup.exe
"C:\Users\Admin\AppData\Local\Temp\HC2Setup.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\HyCam2.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HyCam2.exe" -install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4252,i,2727319350781907497,7925939240893079607,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:8
1⤵
PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CamRes2.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CamRes2.dll
Size 68KB
SHA256 de326afdcf4ac17d6e75d46499685c22f39f837e12348992ce768b2538d69372
MD5 302ff6a4b9f7af939366600a818316c8
SHA1 8aa2404d9004e9b094e165b62a1dc318661bcf1f
SHA512 49e90b4ad4f2b9ae8b84ab0af54e939d9305283811e3be757ac7224575ad2c5fe96cf9eea4f1ad9918578386d3c93afc0549231b3239a7c811e6141b021c13ac
SSDEEP 384:9kvGDPu7Bynv9kjk1xPD+uECEMzf6CDpSz4tionElglg3oYE6NRNBe7Ma:9kHIJxP65w6ClI4tiSeDE6N/Mwa
MD5 SHA1 SHA512 SSDEEP

Submit Download

HomePage.url

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\HomePage.url
Size 82B
SHA256 ae90f5cc0ca1194e999d1b7faf382cad743633876afd5cd0585896e17ec32310
MD5 92b609d63452d6f46670ddb55f4cabf6
SHA1 f8924ca1578173795b5de4041c99fe69a1013552
SHA512 40102772b4133b41e339fc0dde66577c048f55f38d56770dd8ddc25f846053e55d6372bc9e6432edaa202927a16df62fcdf342529bb815c2923706ceadb0ac66
MD5 SHA1 SHA512

Submit Download

HyCam2.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\HyCam2.exe
Size 861KB
SHA256 7465a6b09b41dbc3d0e3b564c6ac6334dc41ff2f3c2dc39bc9e37aede51b7272
MD5 596580454699fdc01b48029905171bd3
SHA1 35d0e563dab1a887f6138298c6500c7aee0032d6
SHA512 fd74477f50a55117f756d2ba495f03c35ebce45d50852d9cb220e4bbcfd32e4569566c8c04d41f263335b262621e8cec88ed92ce395d4671548ab606b2ec491e
SSDEEP 12288:zNdXPnoaoJklS2D3exFmsD476jfVCKjvHAdPv4FxT1ZR:pdXvI2iFmsD476jNCg+PAb17
MD5 SHA1 SHA512 SSDEEP

Submit Download

MClick2.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\MClick2.dll
Size 56KB
SHA256 f1841225411bf68cc24159b001e15072e96368654862470c2cc272d004e6b736
MD5 a4830c567b228dc7f032d88dd772c068
SHA1 ffc190ded8fc1685757f0340814140ab4af81c35
SHA512 d2d112980a3fee36ad7049225fe8a5b79664e991db69dfe2cd5266d9fa694a958b35497a468908532568c61d1c85d0fad19997f60f738318d0e925103a7e6d4e
SSDEEP 768:LA6EralKyE5JBNCsuDhYjGstiodVtATO9Z:LAc8rBWDhU0otAT
MD5 SHA1 SHA512 SSDEEP

Submit Download

agreement.txt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\agreement.txt
Size 3KB
SHA256 e9ad5b2b9960008b0376134bd88c0cdfc1a7c62ef31e2f5ca68419899d50d4bf
MD5 370baa0367be355c97fabc93b1817b9c
SHA1 c5859716d3119d156971a4f9bed535f8ff15e9af
SHA512 4bb1f16855d078f3910830278abe4539884b478f17e7a5f55a8dd5462935f689a948e3f37f01c349035519f09cf1bb5bf4f7095f5748860968deec271f197e49
MD5 SHA1 SHA512

Submit Download

memory/3688-69-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads