fcc332cf3d72a4ea289e41029429587317364aa000f4dc9978325faad4364ccb

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2023, 13:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cc85d8e2a1911exe_JC.exe
Size

30KB
MD5

1cc85d8e2a1911f4f779ec4456f229ad
SHA1

bcc00005cf65579ddedcc768511f6722d548a0b0
SHA256

fcc332cf3d72a4ea289e41029429587317364aa000f4dc9978325faad4364ccb
SHA512

f760e5654e11ccd2865d01b0230b3ac115777fb3d220eadf768c54692e4ef9bd818ece9e29c3ad8bcc7bd35bff8a71689f31601632dbed28531f24a453feaf2c
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUk0nL9aU:bgX4zYcgTEu6QOaryfjUnLh

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	1cc85d8e2a1911exe_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
2120	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2120	1884	1cc85d8e2a1911exe_JC.exe	85
PID 1884 wrote to memory of 2120	1884	1cc85d8e2a1911exe_JC.exe	85
PID 1884 wrote to memory of 2120	1884	1cc85d8e2a1911exe_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\1cc85d8e2a1911exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\1cc85d8e2a1911exe_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
30KB

MD5
4cd545ef04631342be56829e8bf6578d

SHA1
3eae6df1d3fece46d2994c1683a83b324ee5ea41

SHA256
dfd84f18903d4654e5f5ffab347f54fd1964e92d44f0b73020910e6673f2a3b9

SHA512
6c32f7a3573a1892b7ddf5e48b7e0140abd3cac1bb5160ce51d0246c07b14b94c6b4b38a43369c4069827df48e7af92760ce51ef9eb96e68676d6858f32a0d20

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
30KB

MD5
4cd545ef04631342be56829e8bf6578d

SHA1
3eae6df1d3fece46d2994c1683a83b324ee5ea41

SHA256
dfd84f18903d4654e5f5ffab347f54fd1964e92d44f0b73020910e6673f2a3b9

SHA512
6c32f7a3573a1892b7ddf5e48b7e0140abd3cac1bb5160ce51d0246c07b14b94c6b4b38a43369c4069827df48e7af92760ce51ef9eb96e68676d6858f32a0d20

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
30KB

MD5
4cd545ef04631342be56829e8bf6578d

SHA1
3eae6df1d3fece46d2994c1683a83b324ee5ea41

SHA256
dfd84f18903d4654e5f5ffab347f54fd1964e92d44f0b73020910e6673f2a3b9

SHA512
6c32f7a3573a1892b7ddf5e48b7e0140abd3cac1bb5160ce51d0246c07b14b94c6b4b38a43369c4069827df48e7af92760ce51ef9eb96e68676d6858f32a0d20

Download Submit
memory/1884-133-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/1884-134-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/1884-135-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/2120-150-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/2120-151-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download