ffc35d790203b09b6508dc6cbd9b964caea6818c73990f490df35a16cace8ae5

Analysis

max time kernel
132s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2023, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ad812ce272f48dexeexeexeex.exe
Size

86KB
MD5

ad812ce272f48d69902955f597d3c453
SHA1

8fbb75897e933b6e6999c9c275b394c65ca810b6
SHA256

ffc35d790203b09b6508dc6cbd9b964caea6818c73990f490df35a16cace8ae5
SHA512

d3cf7a6047a1f2122071b2ccb3dae200366c8d1c115e2bf780cf96a1d1ac04f8318d7fbe44c26b1a55dd7d4faeff99a33a53a6081c6b9cc0410c849993938fa3
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbNcqamvW8:V6a+pOtEvwDpjtR

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	ad812ce272f48dexeexeexeex.exe

Executes dropped EXE 1 IoCs

pid	Process
4220	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 4220	1096	ad812ce272f48dexeexeexeex.exe	79
PID 1096 wrote to memory of 4220	1096	ad812ce272f48dexeexeexeex.exe	79
PID 1096 wrote to memory of 4220	1096	ad812ce272f48dexeexeexeex.exe	79

C:\Users\Admin\AppData\Local\Temp\ad812ce272f48dexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\ad812ce272f48dexeexeexeex.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
86KB

MD5
ef13ed186c8f11e6b62555110a630170

SHA1
5c05e71718c5f70fc530fa2a89e24bdbbc3877b4

SHA256
ec7b66931dc324800d77f28bd8c34d30502c178bcfdc96b062736b5fca97e10b

SHA512
492105e51f3e83d5fccf477cab6e003b8ecebfeb6f7594e34eb0eefa6635c3f0dc7cae33cf8bff8d43ce468c388fc1610208e44724ba5fbb46109e5ae6014b7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
86KB

MD5
ef13ed186c8f11e6b62555110a630170

SHA1
5c05e71718c5f70fc530fa2a89e24bdbbc3877b4

SHA256
ec7b66931dc324800d77f28bd8c34d30502c178bcfdc96b062736b5fca97e10b

SHA512
492105e51f3e83d5fccf477cab6e003b8ecebfeb6f7594e34eb0eefa6635c3f0dc7cae33cf8bff8d43ce468c388fc1610208e44724ba5fbb46109e5ae6014b7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
86KB

MD5
ef13ed186c8f11e6b62555110a630170

SHA1
5c05e71718c5f70fc530fa2a89e24bdbbc3877b4

SHA256
ec7b66931dc324800d77f28bd8c34d30502c178bcfdc96b062736b5fca97e10b

SHA512
492105e51f3e83d5fccf477cab6e003b8ecebfeb6f7594e34eb0eefa6635c3f0dc7cae33cf8bff8d43ce468c388fc1610208e44724ba5fbb46109e5ae6014b7b

Download Submit
memory/1096-136-0x0000000002300000-0x0000000002306000-memory.dmp

Filesize
24KB

Download
memory/1096-137-0x0000000002220000-0x0000000002226000-memory.dmp

Filesize
24KB

Download
memory/4220-152-0x00000000020E0000-0x00000000020E6000-memory.dmp

Filesize
24KB

Download