3994c8e0aecd846d4745bee253585ab2787b6b5fe80ccac607dada63db1b4177

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2023, 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

H90490861252¬F.exe
Size

667KB
MD5

f4ebd2a2d0ff857cca296b6d868e94b0
SHA1

e284b010ec634795cfe4da2cb4ea376480fdb6d4
SHA256

3994c8e0aecd846d4745bee253585ab2787b6b5fe80ccac607dada63db1b4177
SHA512

11811a3f7c67c279f754f4202c4c24cad8d2953b0863bb2663019b3d5ca966e605dad567241e88cdd4905aba3e5b8243292a8e74c68d8805e6d228df17c5f828
SSDEEP

12288:Rgi0cO/aRB7kBfqQqVw2yJ5rcQm6dTxqooWjrARw75WSaLpG/4YBZRyIL9oI0+Ip:6i0vTcSaLpG/4AZfBT0+Ip

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	H90490861252¬F.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\id_win.lnk	cscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 4656	1160	H90490861252¬F.exe	82
PID 1160 wrote to memory of 4656	1160	H90490861252¬F.exe	82
PID 4656 wrote to memory of 1864	4656	cmd.exe	84
PID 4656 wrote to memory of 1864	4656	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\H90490861252¬F.exe
"C:\Users\Admin\AppData\Local\Temp\H90490861252¬F.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\ThQeXH.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp\UcdtuXSR.vbs
    3⤵
    - Drops startup file
    PID:1864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ThQeXH.bat

Filesize
578B

MD5
52f8b0c2ff2d1f041d24871817e4c832

SHA1
6e5cc4e1ed9ff023639531a4349b6405ef366b78

SHA256
fb8be31821f62af19a342fada56728c30e8bb0670d788e3eec508edc65e53179

SHA512
93737da5f5fcb92d01abbf2b18870b5dc41f2c854302c8b8685c76a413843c02fddb92b5571f9ce76b4d2a3d618ee4df956adeb4807495eccf4acb4a1aa5750d

Download Submit
C:\Users\Admin\AppData\Local\Temp\UcdtuXSR.vbs

Filesize
253B

MD5
79ae798486da31d4914ae0696bcc942b

SHA1
98c14b3281fa645adf9bc490ade15b5d2fb40d6e

SHA256
5b864bdf6fe6646e52ed4a3034e2146210a4671128bfc6d7350ce41b07298ad5

SHA512
a3b8fa247919a18f1a449a56e9516340bdb74ff0bcc377e29acfeb323e0bbb10ed326237897c1f4e3a13063021aa745729e94340bff0f2c706ae5a009777332e

Download Submit