8a79c3b6fdc43cad49e24f88d00d9bca9ec6c953f2972516c2b89c81f9bba966

Analysis

max time kernel
148s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2023 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad9d1023556f6dexeexeexeex.exe
Size

34KB
MD5

ad9d1023556f6df4c4e587555284f426
SHA1

467c682282e9a549be3f5a6be1e319401e705871
SHA256

8a79c3b6fdc43cad49e24f88d00d9bca9ec6c953f2972516c2b89c81f9bba966
SHA512

dc2d4e6f8745b00302fa7985c9d930580449499fe3b2732b6255a4c82767535a1716e4be19fa3b77c90db9e88292abc86a02f48c494dc1cf917f67bc936139e7
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf6XT+0vJsghb5:bgX4zYcgTEu6QOaryfjqDlC6Jtb5

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	ad9d1023556f6dexeexeexeex.exe

Executes dropped EXE 1 IoCs

pid	Process
4488	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 4488	1752	ad9d1023556f6dexeexeexeex.exe	85
PID 1752 wrote to memory of 4488	1752	ad9d1023556f6dexeexeexeex.exe	85
PID 1752 wrote to memory of 4488	1752	ad9d1023556f6dexeexeexeex.exe	85

C:\Users\Admin\AppData\Local\Temp\ad9d1023556f6dexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\ad9d1023556f6dexeexeexeex.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:4488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
34KB

MD5
b4d4f5197c143150049c9c9ffd44276f

SHA1
f7caefc96d2d1ce698bb1ac6109b232f200dc21c

SHA256
73e4faa64cb18ad74b7332a52312ec515a721ddac08d45290886eb793f42c6d6

SHA512
e81229b8fffbe1e542da2737d61a2c4cdd4f2d3b96014f173ea95b84acba26ce6e9e39febaacaf4f4d90329c68783d84dd727a6d398b74275b7f2d8d653ed6a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
34KB

MD5
b4d4f5197c143150049c9c9ffd44276f

SHA1
f7caefc96d2d1ce698bb1ac6109b232f200dc21c

SHA256
73e4faa64cb18ad74b7332a52312ec515a721ddac08d45290886eb793f42c6d6

SHA512
e81229b8fffbe1e542da2737d61a2c4cdd4f2d3b96014f173ea95b84acba26ce6e9e39febaacaf4f4d90329c68783d84dd727a6d398b74275b7f2d8d653ed6a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
34KB

MD5
b4d4f5197c143150049c9c9ffd44276f

SHA1
f7caefc96d2d1ce698bb1ac6109b232f200dc21c

SHA256
73e4faa64cb18ad74b7332a52312ec515a721ddac08d45290886eb793f42c6d6

SHA512
e81229b8fffbe1e542da2737d61a2c4cdd4f2d3b96014f173ea95b84acba26ce6e9e39febaacaf4f4d90329c68783d84dd727a6d398b74275b7f2d8d653ed6a9

Download Submit
memory/1752-133-0x0000000002220000-0x0000000002226000-memory.dmp

Filesize
24KB

Download
memory/1752-134-0x0000000003120000-0x0000000003126000-memory.dmp

Filesize
24KB

Download
memory/4488-149-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download