fc5fac607869a9008e7ae28a38e3ba404def6ea765ebc569c3d8ec45534e4056

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2023 17:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02d9ee21534137exe_JC.exe
Size

98KB
MD5

02d9ee215341377b7639ce27231b08e3
SHA1

569305f1b347627f961c92a48b0c039475566fef
SHA256

fc5fac607869a9008e7ae28a38e3ba404def6ea765ebc569c3d8ec45534e4056
SHA512

77f6b36e5dab4f7b0a0f82080539f3dbdea347b900bfc781578e6bf8f1b22f617e233389a6c996f57c4bae933db5e8246a8e4e061b56a6fc932ebfdf2edf0edc
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNgwcEIH:V6a+pOtEvwDpjtzn+

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation	02d9ee21534137exe_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
1604	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1604	2236	02d9ee21534137exe_JC.exe	86
PID 2236 wrote to memory of 1604	2236	02d9ee21534137exe_JC.exe	86
PID 2236 wrote to memory of 1604	2236	02d9ee21534137exe_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\02d9ee21534137exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\02d9ee21534137exe_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
98KB

MD5
4c4cde4598b16ec8706248eabb3e4549

SHA1
1077ed819ea8b1ad34a67a935c9a5f0b6eac9e46

SHA256
edb72355809abe4f7f852d9190c1402622f11aa982bf8d52efa53196ec5eed69

SHA512
4c16c9aefe0c8bc432a92b7857375a9cfd5103f31e67a93060de13c1a3451ff22f38529bc26e2acc5081a2f2262b4df3533b2ec70196656931a50122c4b62d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
98KB

MD5
4c4cde4598b16ec8706248eabb3e4549

SHA1
1077ed819ea8b1ad34a67a935c9a5f0b6eac9e46

SHA256
edb72355809abe4f7f852d9190c1402622f11aa982bf8d52efa53196ec5eed69

SHA512
4c16c9aefe0c8bc432a92b7857375a9cfd5103f31e67a93060de13c1a3451ff22f38529bc26e2acc5081a2f2262b4df3533b2ec70196656931a50122c4b62d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
98KB

MD5
4c4cde4598b16ec8706248eabb3e4549

SHA1
1077ed819ea8b1ad34a67a935c9a5f0b6eac9e46

SHA256
edb72355809abe4f7f852d9190c1402622f11aa982bf8d52efa53196ec5eed69

SHA512
4c16c9aefe0c8bc432a92b7857375a9cfd5103f31e67a93060de13c1a3451ff22f38529bc26e2acc5081a2f2262b4df3533b2ec70196656931a50122c4b62d50

Download Submit
memory/1604-151-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/1604-150-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/2236-133-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/2236-134-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/2236-135-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download