Resubmissions

17/11/2024, 15:11

241117-skp3lasere 8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2024, 15:11

General

  • Target

    Setup_10024.exe

  • Size

    66.5MB

  • MD5

    a9dfcaf306acbfffcfa73dd2447817c1

  • SHA1

    2cd707c6a9d1f7860edeccb3caf40f92777c7cd0

  • SHA256

    e54b941d2033722df7463bcd9f3ab3e909fc16254721c0455d6214f28a2150c8

  • SHA512

    60e9269d57845656f92f5aa206be75b22974107693a3b87bfb261bfe0a3b7451eb9381341971816de61f646ec80a4746f63ab8e7b1fd31f9b9c671647a51e94f

  • SSDEEP

    393216:gHHFEHHp1UNNtUWnYv3QYDez3QzCQSPIaXSz69II65rUV4:r1UNNtUWnw3ivhdS+9Ix5rUV4

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup_10024.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup_10024.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:60
    • C:\Users\Admin\AppData\Local\Temp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3936

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsaAC8E.tmp\LangDLL.dll

          Filesize

          5KB

          MD5

          a1cd3f159ef78d9ace162f067b544fd9

          SHA1

          72671fdf4bfeeb99b392685bf01081b4a0b3ae66

          SHA256

          47b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6

          SHA512

          ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362

        • C:\Users\Admin\AppData\Local\Temp\nsaAC8E.tmp\System.dll

          Filesize

          11KB

          MD5

          bf712f32249029466fa86756f5546950

          SHA1

          75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

          SHA256

          7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

          SHA512

          13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

        • C:\Users\Admin\AppData\Local\Temp\nsaAC8E.tmp\nsDialogs.dll

          Filesize

          9KB

          MD5

          4ccc4a742d4423f2f0ed744fd9c81f63

          SHA1

          704f00a1acc327fd879cf75fc90d0b8f927c36bc

          SHA256

          416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6

          SHA512

          790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

        • C:\Users\Admin\AppData\Local\Temp\setup.exe

          Filesize

          12.3MB

          MD5

          76954d7dbf005d6db5e38d64f25a8c20

          SHA1

          054ad10803aa95f512a2c56293be7d1a287696f7

          SHA256

          e9e2eb114941f9f9157b4fb139e5588665fb89b709df82d4a8346ae66ccf03e1

          SHA512

          49e77880255470096830059bda1baf1d955f7f33659118995495aa6a6e090e32c798a8568504f213a90c4d3c3c81db41c22c54359d0689adb7b233c96c4fff4a