0ac8093eb7a5cad5f85c462be90ab5c33a093490e3118f1d98846fd5bffee686

Resubmissions

24-01-2025 06:13

250124-gyvpfstpcy 7

24-11-2024 20:35

241124-zc5lmstrbp 10

Analysis

max time kernel
12s
max time network
14s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
24-01-2025 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DexLogo.png
Size

104KB
MD5

3c996b6f3a892ca41e22b203714c21b2
SHA1

45a2af707f4f93196f05a0c30db044e14b0698bb
SHA256

0ac8093eb7a5cad5f85c462be90ab5c33a093490e3118f1d98846fd5bffee686
SHA512

68f4162e0d9e18f39687d14babc4cb4e63b422dc8295f2a0bc37d8fc0dd3b72889b1e9fdb99a92c17714518081b7471a3371ea921bd8769a162c5ec498960798
SSDEEP

1536:S9ISS5AVuCkdD3v5ytq3s7uhrQmxxZOeIBEr9UiyV:S9IltCwf5cqgO02xZwEZWV

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2512	mspaint.exe
2512	mspaint.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2512	mspaint.exe
2512	mspaint.exe
2512	mspaint.exe
2512	mspaint.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 2512	4272	cmd.exe	82
PID 4272 wrote to memory of 2512	4272	cmd.exe	82

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DexLogo.png
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\DexLogo.png"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads