b8d1e274e76cd0e9ff78de57afe85f28b9d79620745c36dde51f5867039ce49f

Analysis

max time kernel
96s
max time network
146s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
21-12-2024 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Password.HERE.jpg
Size

2KB
MD5

b49a7202fb4a6cde0d9d8d4b933a7b76
SHA1

ac1f52da6f92d6588fb9813756a0190a7f167bd3
SHA256

ff5026d2e6a35f58170d6c0d12789682d800f29cf95e37da7e1af339a674924d
SHA512

6154c87492fdb5c61dd65caecf40ba56c509ff358c815e7de05608bdc1ea46ec5b049161edc1ada837e6f979883871b661aeb73459388330c61f89bf33da3f5c

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4560	mspaint.exe
4560	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4560	mspaint.exe
4560	mspaint.exe
4560	mspaint.exe
4560	mspaint.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 4560	3520	cmd.exe	83
PID 3520 wrote to memory of 4560	3520	cmd.exe	83

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Password.HERE.jpg
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Password.HERE.jpg"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads