Analysis
-
max time kernel
419s -
max time network
422s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
19-11-2024 16:48
General
-
Target
obraz_2024-11-19_174224454.png
-
Size
36KB
-
MD5
12de79588850f58437e74944011007b3
-
SHA1
ecf085d8590ae30abace863588df73bdff58b65c
-
SHA256
8066f602091cd2948e4a6649af8c722d75909a9de28c02371464aa5c893d6f4d
-
SHA512
463567654cf745efd5d2cb1f30df55bc77ffee5114b4094b72ce4cdfb2c6a7bab64c79c6a419d676faec9673cdcd5a0fab052a2d292ab93b45f1f00843121880
-
SSDEEP
768:EMzOFc9xAIuLx6d+k2iXFXAO8q4l1cHNeJ7Is1AJfj:EMzsJLsCiSlK4JbKfj
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\obraz_2024-11-19_174224454.png1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\obraz_2024-11-19_174224454.png"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵