e85f9db9532e3951cfb64e85da821811a9ce1bc5d9b9075b5106a70f790a044c

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2023, 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-06-04_f875745f3c0628_JC.exe
Size

35KB
MD5

f875745f3c06282614fef50dbb7b91f9
SHA1

e64180f93eb25f0900d9551e2b3ffe4901f93b23
SHA256

e85f9db9532e3951cfb64e85da821811a9ce1bc5d9b9075b5106a70f790a044c
SHA512

99943b438b29b719901065af411bdf74c03c0b9c63ccabd89a59dd03245e97a50a043db57acdbd04f1e247080b75096deeec6083bce2150d3486d9f3bf1e1508
SSDEEP

768:q0ZziOWwULueOSdE8tOOtEvwDpjej4AYsqSh+DETkejlst:q0zizzOSxMOtEvwDpjC39+D+5ZU

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	2023-06-04_f875745f3c0628_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
2792	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 2792	5048	2023-06-04_f875745f3c0628_JC.exe	85
PID 5048 wrote to memory of 2792	5048	2023-06-04_f875745f3c0628_JC.exe	85
PID 5048 wrote to memory of 2792	5048	2023-06-04_f875745f3c0628_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\2023-06-04_f875745f3c0628_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-06-04_f875745f3c0628_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
36KB

MD5
45c6cc1ffd32bed1cc988d4b5f098fe3

SHA1
f913b769a026572749e179be13d09eabad4262db

SHA256
36fb85894232cd6d23501ff2712c482de6cd339b1135d698ffe335cf25ae98bf

SHA512
4418eb7341e32143c2eee0922fce5d584738131941f1cf37acb961eaf41ad4c23dac5ca259b01871b392a2b5a6f7b3625e701ee59b21ec9ce1fd11977b9b7536

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
36KB

MD5
45c6cc1ffd32bed1cc988d4b5f098fe3

SHA1
f913b769a026572749e179be13d09eabad4262db

SHA256
36fb85894232cd6d23501ff2712c482de6cd339b1135d698ffe335cf25ae98bf

SHA512
4418eb7341e32143c2eee0922fce5d584738131941f1cf37acb961eaf41ad4c23dac5ca259b01871b392a2b5a6f7b3625e701ee59b21ec9ce1fd11977b9b7536

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
36KB

MD5
45c6cc1ffd32bed1cc988d4b5f098fe3

SHA1
f913b769a026572749e179be13d09eabad4262db

SHA256
36fb85894232cd6d23501ff2712c482de6cd339b1135d698ffe335cf25ae98bf

SHA512
4418eb7341e32143c2eee0922fce5d584738131941f1cf37acb961eaf41ad4c23dac5ca259b01871b392a2b5a6f7b3625e701ee59b21ec9ce1fd11977b9b7536

Download Submit
memory/2792-152-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/2792-153-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/2792-159-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/5048-133-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/5048-134-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/5048-135-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/5048-136-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/5048-150-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download