Resubmissions
17/11/2024, 15:11
241117-skp3lasere 8Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/11/2024, 15:11
Static task
static1
Behavioral task
behavioral1
Sample
Setup_10024.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Setup_10024.exe
Resource
win10v2004-20241007-en
General
-
Target
Setup_10024.exe
-
Size
66.5MB
-
MD5
a9dfcaf306acbfffcfa73dd2447817c1
-
SHA1
2cd707c6a9d1f7860edeccb3caf40f92777c7cd0
-
SHA256
e54b941d2033722df7463bcd9f3ab3e909fc16254721c0455d6214f28a2150c8
-
SHA512
60e9269d57845656f92f5aa206be75b22974107693a3b87bfb261bfe0a3b7451eb9381341971816de61f646ec80a4746f63ab8e7b1fd31f9b9c671647a51e94f
-
SSDEEP
393216:gHHFEHHp1UNNtUWnYv3QYDez3QzCQSPIaXSz69II65rUV4:r1UNNtUWnw3ivhdS+9Ix5rUV4
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation Setup_10024.exe -
Executes dropped EXE 1 IoCs
pid Process 3936 Setup.exe -
Loads dropped DLL 3 IoCs
pid Process 3936 Setup.exe 3936 Setup.exe 3936 Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup_10024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 60 Setup_10024.exe 60 Setup_10024.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 60 Setup_10024.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3936 Setup.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 60 wrote to memory of 3936 60 Setup_10024.exe 87 PID 60 wrote to memory of 3936 60 Setup_10024.exe 87 PID 60 wrote to memory of 3936 60 Setup_10024.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup_10024.exe"C:\Users\Admin\AppData\Local\Temp\Setup_10024.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5a1cd3f159ef78d9ace162f067b544fd9
SHA172671fdf4bfeeb99b392685bf01081b4a0b3ae66
SHA25647b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6
SHA512ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362
-
Filesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
Filesize
9KB
MD54ccc4a742d4423f2f0ed744fd9c81f63
SHA1704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
-
Filesize
12.3MB
MD576954d7dbf005d6db5e38d64f25a8c20
SHA1054ad10803aa95f512a2c56293be7d1a287696f7
SHA256e9e2eb114941f9f9157b4fb139e5588665fb89b709df82d4a8346ae66ccf03e1
SHA51249e77880255470096830059bda1baf1d955f7f33659118995495aa6a6e090e32c798a8568504f213a90c4d3c3c81db41c22c54359d0689adb7b233c96c4fff4a