9d3a321f7e2047d52753c296b0af0f9d01095187e4f2b5b0c68127525f94814b

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2023 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20369e1bee0343exe_JC.exe
Size

35KB
MD5

20369e1bee0343c3223e327d57f38f56
SHA1

9bd52bef528a4dbe672a8b30cdcc2a9ebb43df5d
SHA256

9d3a321f7e2047d52753c296b0af0f9d01095187e4f2b5b0c68127525f94814b
SHA512

b2d4f5808330501387e5c1097185747ed52f6661b185feca0bda9239f98d39632aaded15822bef035f90cb8e94d391a79db8fe8ade13f35c2034bf5e03038123
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf6XT+0vJsg5b5UJ:bgX4zYcgTEu6QOaryfjqDlC6JFbKJ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	20369e1bee0343exe_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
4236	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 4236	4664	20369e1bee0343exe_JC.exe	85
PID 4664 wrote to memory of 4236	4664	20369e1bee0343exe_JC.exe	85
PID 4664 wrote to memory of 4236	4664	20369e1bee0343exe_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\20369e1bee0343exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\20369e1bee0343exe_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:4236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
35KB

MD5
101997a5350eee9df114c6d931d21ea0

SHA1
849627fce777383bbf519d52fede49183ee962e0

SHA256
174093df443e89688d93ab6c5eedf16a072aaa6b9ad68edcb304112743689781

SHA512
6c7ed59b0ff96ee4b0b0c192a84a583c608441a2d5d86cc5eba79c980042c3ef2d5160d570baffebb80d8d03d34a82430f95c90196cd458e0501e23bf0954f36

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
35KB

MD5
101997a5350eee9df114c6d931d21ea0

SHA1
849627fce777383bbf519d52fede49183ee962e0

SHA256
174093df443e89688d93ab6c5eedf16a072aaa6b9ad68edcb304112743689781

SHA512
6c7ed59b0ff96ee4b0b0c192a84a583c608441a2d5d86cc5eba79c980042c3ef2d5160d570baffebb80d8d03d34a82430f95c90196cd458e0501e23bf0954f36

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
35KB

MD5
101997a5350eee9df114c6d931d21ea0

SHA1
849627fce777383bbf519d52fede49183ee962e0

SHA256
174093df443e89688d93ab6c5eedf16a072aaa6b9ad68edcb304112743689781

SHA512
6c7ed59b0ff96ee4b0b0c192a84a583c608441a2d5d86cc5eba79c980042c3ef2d5160d570baffebb80d8d03d34a82430f95c90196cd458e0501e23bf0954f36

Download Submit
memory/4236-150-0x00000000022C0000-0x00000000022C6000-memory.dmp

Filesize
24KB

Download
memory/4236-151-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/4664-133-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/4664-134-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/4664-135-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download