b846237e9c624397c4674df926f04547e7058745387dd69e0f5d29f150f860b5

Analysis

max time kernel
149s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SSA_Setup.exe
Size

907KB
MD5

4fb4126d5eea5f975519d057e4dc4a6e
SHA1

b3a33346f79aaaff115301092075ae9768fddcdd
SHA256

0a420cf9275db2a9bbc45556d4de703c79583109c73a1483f5d3656119529fee
SHA512

4849335796ab80a784f7c7c38014e4994497242c1f66edf932de48bc5648b497c4edb418fdb936ada7ba3e68a6913b2934465848f35d4d78c6aef4cf2bbb68d0
SSDEEP

24576:f20nbd14HueX8fnT2XipstF8MPTwwqegXC75ld1qSVpcqG:f2MdiHRMiipsF8ItJd1qapcqG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1564	SSA_Setup.tmp

Loads dropped DLL 2 IoCs

pid	Process
1564	SSA_Setup.tmp
1564	SSA_Setup.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SSA_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SSA_Setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 1564	4104	SSA_Setup.exe	82
PID 4104 wrote to memory of 1564	4104	SSA_Setup.exe	82
PID 4104 wrote to memory of 1564	4104	SSA_Setup.exe	82

C:\Users\Admin\AppData\Local\Temp\SSA_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\SSA_Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Users\Admin\AppData\Local\Temp\is-0STHS.tmp\SSA_Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0STHS.tmp\SSA_Setup.tmp" /SL5="$70206,676464,54272,C:\Users\Admin\AppData\Local\Temp\SSA_Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-0STHS.tmp\SSA_Setup.tmp

Filesize
695KB

MD5
620f32e56b46e90e8aee43febc59f6e3

SHA1
d5edd63dd1390a1420b85f746e12a66625ae9354

SHA256
bcc9d63213012bf25a37f48015e5f755d359f3b08d05d35319b03b4a72710730

SHA512
8a9d2a2eb3891265cec379978399ad6c9b4bf3e12e0f381946b4390621b943b97fa04fbb87ad628652bd765b706eb2ff56001f24de24e9bcc487a59ca2f07d9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BS1SL.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b6f11a0ab7715f570f45900a1fe84732

SHA1
77b1201e535445af5ea94c1b03c0a1c34d67a77b

SHA256
e47dd306a9854599f02bc1b07ca6dfbd5220f8a1352faa9616d1a327de0bbf67

SHA512
78a757e67d21eb7cc95954df15e3eeff56113d6b40fb73f0c5f53304265cc52c79125d6f1b3655b64f9a411711b5b70f746080d708d7c222f4e65bad64b1b771

Download Submit
memory/1564-38-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-30-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-46-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-44-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-20-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-22-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-24-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-26-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-28-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-10-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-32-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-34-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-36-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-42-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-40-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4104-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4104-19-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4104-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download