4e32af9f57ea2c02943265d1d5185e9573e029a6975df110aa0a4fdaa135b4c4

Analysis

max time kernel
38s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2023 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

challange_Benign_4e32af9f57ea2c02943265d1d5185e9573e029a6975df110aa0a4fdaa135b4c4.exe
Size

36KB
MD5

2f21a5bd845fd18d81b9c319d37543fd
SHA1

c06a06f0261b4b30b559e718ed95d17c7343d905
SHA256

4e32af9f57ea2c02943265d1d5185e9573e029a6975df110aa0a4fdaa135b4c4
SHA512

a7bd86401169367bbf5a61ac88aff3cb07de973ffee74a07daf58aad5cdfd8762a2ddc0e9019369cc80e25d28a1727880598adfc5f759451b6edc9d60948a954
SSDEEP

768:5bsCogv5ESs9BDykUWZ0+uD3jqE3ViV6Ol:PREBs+O3jql6Ol

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation	challange_Benign_4e32af9f57ea2c02943265d1d5185e9573e029a6975df110aa0a4fdaa135b4c4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2328	timeout.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4904	1948	challange_Benign_4e32af9f57ea2c02943265d1d5185e9573e029a6975df110aa0a4fdaa135b4c4.exe	78
PID 1948 wrote to memory of 4904	1948	challange_Benign_4e32af9f57ea2c02943265d1d5185e9573e029a6975df110aa0a4fdaa135b4c4.exe	78
PID 1948 wrote to memory of 4904	1948	challange_Benign_4e32af9f57ea2c02943265d1d5185e9573e029a6975df110aa0a4fdaa135b4c4.exe	78
PID 4904 wrote to memory of 2544	4904	cmd.exe	81
PID 4904 wrote to memory of 2544	4904	cmd.exe	81
PID 4904 wrote to memory of 2544	4904	cmd.exe	81
PID 4904 wrote to memory of 2328	4904	cmd.exe	82
PID 4904 wrote to memory of 2328	4904	cmd.exe	82
PID 4904 wrote to memory of 2328	4904	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\challange_Benign_4e32af9f57ea2c02943265d1d5185e9573e029a6975df110aa0a4fdaa135b4c4.exe
"C:\Users\Admin\AppData\Local\Temp\challange_Benign_4e32af9f57ea2c02943265d1d5185e9573e029a6975df110aa0a4fdaa135b4c4.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B239.tmp\start1.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:2544
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:2328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B239.tmp\start1.bat

Filesize
743B

MD5
40725cddb76b14707bad0d522a81b4ca

SHA1
19cf0c213a0a6e5734e9fd689515033334298ed1

SHA256
9848b0cf80710c0a6600d043f5ecb101e0bc0319c4edb965a4bcf945193a4196

SHA512
6ed9bdea4324f76c6f877f0321b8db63c7dc4ceb20e0c31ca7fea26c986fafd0e3208920bdc45347211030d892d20a71d422e4264d47e86a481d4208708ceaea

Download Submit