c0adaa84600a272780e9937a647329dca67e6c004f5b58098139af09fc2e7b1c

Resubmissions

04-12-2024 04:28

241204-e3ta3sxlep 1

04-12-2024 03:02

241204-djgmhatpdm 1

04-12-2024 02:46

241204-c9ep6axpg1 10

Analysis

max time kernel
97s
max time network
144s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
04-12-2024 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Logo.png
Size

27KB
MD5

7fd31ab02a460425b02424d88516e231
SHA1

69d6c2e823eb4a4b4714e3e454316cca6465ed9e
SHA256

d5ff2f45dd0e5cdc6fbffd3f5fa9098676d46f8aafd74d6d52d298231d6dc394
SHA512

c02b3a0b99d426ab2b37fd6a97b0f72624622d71af7f923e2057ca533b58cefb006f2562ea7554031fc5eaa779e748918ecf2029779e80a1b73332637c63bab8
SSDEEP

768:JpJTH80OiNAR+xnHYKHgHgOwy8B+Om0LOu6:JphLNO+nlx3N0/0LZ6

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3836	mspaint.exe
3836	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3836	mspaint.exe
3836	mspaint.exe
3836	mspaint.exe
3836	mspaint.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 3836	2372	cmd.exe	81
PID 2372 wrote to memory of 3836	2372	cmd.exe	81

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Logo.png
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Logo.png"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads