715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f

General

Target

715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe
Size

841KB
MD5

4a667433343828c12e9c5679f707db74
SHA1

1ef28cff2d80369bece4b28b88beaf52342cc62a
SHA256

715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f
SHA512

c03b335895ac4a0ae9825000c4ef9d73f67e0a9475556567fdfe547ab9f03fbfa9c63a1a4db8b3cf89ddfa36b8db37d178fd3bfa3c5945519e20ef06493690b9
SSDEEP

24576:muS04YNEMuExDiU6E5R9s8xY/2l/df6Ibt+rH:mq4auS+UjfU2Tf6Ibt+r

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe

Executes dropped EXE 1 IoCs

Processes:

WindowsInput.exe

pid process

2376 WindowsInput.exe

pid	process
2376	WindowsInput.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe

Drops file in System32 directory 3 IoCs

Processes:

715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exeWindowsInput.exe

description	ioc	process
File created	C:\Windows\SysWOW64\WindowsInput.exe	715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe
File opened for modification	C:\Windows\SysWOW64\WindowsInput.InstallLog	WindowsInput.exe
File created	C:\Windows\SysWOW64\WindowsInput.InstallState	WindowsInput.exe

Drops file in Windows directory 3 IoCs

Processes:

715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe

description	ioc	process
File opened for modification	C:\Windows\assembly	715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe
File created	C:\Windows\assembly\Desktop.ini	715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe

Modifies registry class 2 IoCs

Processes:

715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

2984 OpenWith.exe

pid	process
2984	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe

description	pid	process	target process
PID 5052 wrote to memory of 2376	5052	715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe	WindowsInput.exe
PID 5052 wrote to memory of 2376	5052	715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe	WindowsInput.exe

C:\Users\Admin\AppData\Local\Temp\715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe
"C:\Users\Admin\AppData\Local\Temp\715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SysWOW64\WindowsInput.exe
  "C:\Windows\SysWOW64\WindowsInput.exe" --install
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2376

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows.old\WINDOWS

Filesize
841KB

MD5
4a667433343828c12e9c5679f707db74

SHA1
1ef28cff2d80369bece4b28b88beaf52342cc62a

SHA256
715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f

SHA512
c03b335895ac4a0ae9825000c4ef9d73f67e0a9475556567fdfe547ab9f03fbfa9c63a1a4db8b3cf89ddfa36b8db37d178fd3bfa3c5945519e20ef06493690b9

Download Submit
C:\Windows\SysWOW64\WindowsInput.InstallLog

Filesize
597B

MD5
c2291863df7c2d3038ce3c22fa276506

SHA1
7b7d2bc07a6c35523807342c747c9b6a19f3184e

SHA256
14504199bede3f46129969dbd2b7680f2e5b7fcd73a3e427ce1bb6217a6d13da

SHA512
00bf40174a67e3e663d18a887c5b461a1e5ead0b27f0a139d87969158c58f4ca72cfa5a731dda239356192ca4cb5ac6ae2b0e37401d534e686cabacd3cbee8fa

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe

Filesize
21KB

MD5
e854a4636afc652b320e12e50ba4080e

SHA1
8a4ac6ecc22ee5f3a8ec846d38b41ff18c641fdc

SHA256
94b9c78c6fa2bf61fba20a08ad4563f7dd2f5668c28eff227965ce0a2032d5d5

SHA512
30aabd5079b6ed0948eb70fd18e9166096e4ba5d1d47fc35b7270f931d19bbe6cd929b6010f70297bf5272dc5a79e2523721354d211c4080d68ad8d17e316118

Download Submit
memory/2376-16-0x00007FFA20535000-0x00007FFA20536000-memory.dmp

Filesize
4KB

Download
memory/2376-17-0x000000001BB00000-0x000000001BB18000-memory.dmp

Filesize
96KB

Download
memory/2376-18-0x000000001BB40000-0x000000001BB60000-memory.dmp

Filesize
128KB

Download
memory/2376-19-0x00007FFA20280000-0x00007FFA20C21000-memory.dmp

Filesize
9.6MB

Download
memory/2376-20-0x00007FFA20280000-0x00007FFA20C21000-memory.dmp

Filesize
9.6MB

Download
memory/2376-23-0x000000001BE60000-0x000000001BE84000-memory.dmp

Filesize
144KB

Download
memory/2376-31-0x000000001C7C0000-0x000000001CC8E000-memory.dmp

Filesize
4.8MB

Download
memory/2376-32-0x000000001CD30000-0x000000001CDCC000-memory.dmp

Filesize
624KB

Download
memory/2376-49-0x00007FFA20280000-0x00007FFA20C21000-memory.dmp

Filesize
9.6MB

Download
memory/5052-0-0x00000000751A2000-0x00000000751A3000-memory.dmp

Filesize
4KB

Download
memory/5052-2-0x00000000751A0000-0x0000000075751000-memory.dmp

Filesize
5.7MB

Download
memory/5052-1-0x00000000751A0000-0x0000000075751000-memory.dmp

Filesize
5.7MB

Download
memory/5052-62-0x00000000751A0000-0x0000000075751000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads