d6cf62c5b848fa4e0fc44358f1c2d41ea13a8de179ee879e76530f443f37b6da

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2023, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3c09559542e020exeexe_JC.exe
Size

28KB
MD5

3c09559542e02012a481b22e93803cb3
SHA1

0c4275763a52af168e4235bdb256a78f0092d6b8
SHA256

d6cf62c5b848fa4e0fc44358f1c2d41ea13a8de179ee879e76530f443f37b6da
SHA512

b72353bc6bab450f481ff2a99a2e1cccd84101f5689609bd06a111eac25bf2fbb490822367889ebd38ab7e80848ba2ea49e4047d94e5ce1dc7fa8644ea0d1ebb
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUZ0psObGqWBxL:bA74zYcgT/Ekd0ryfjeRtBd

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	3c09559542e020exeexe_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
1452	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 1452	332	3c09559542e020exeexe_JC.exe	86
PID 332 wrote to memory of 1452	332	3c09559542e020exeexe_JC.exe	86
PID 332 wrote to memory of 1452	332	3c09559542e020exeexe_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\3c09559542e020exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\3c09559542e020exeexe_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:332
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
29KB

MD5
954ceff9293b4ba49af936f528ac3d4f

SHA1
06604a75a82ec9ffecb78f55783855933bd9447b

SHA256
a292932799e421e4be9a566aa22d364480ebee3ae0ec1d6afa5f77fd5fcf66cd

SHA512
654e53ba0fb58358a0183d3656481b7fe8e350f3da06d408671d18ae15fc7f26038a6c0927cefc240921164d1285afc050bd0d9d66e5c98f3f303239b40e9249

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
29KB

MD5
954ceff9293b4ba49af936f528ac3d4f

SHA1
06604a75a82ec9ffecb78f55783855933bd9447b

SHA256
a292932799e421e4be9a566aa22d364480ebee3ae0ec1d6afa5f77fd5fcf66cd

SHA512
654e53ba0fb58358a0183d3656481b7fe8e350f3da06d408671d18ae15fc7f26038a6c0927cefc240921164d1285afc050bd0d9d66e5c98f3f303239b40e9249

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
29KB

MD5
954ceff9293b4ba49af936f528ac3d4f

SHA1
06604a75a82ec9ffecb78f55783855933bd9447b

SHA256
a292932799e421e4be9a566aa22d364480ebee3ae0ec1d6afa5f77fd5fcf66cd

SHA512
654e53ba0fb58358a0183d3656481b7fe8e350f3da06d408671d18ae15fc7f26038a6c0927cefc240921164d1285afc050bd0d9d66e5c98f3f303239b40e9249

Download Submit
memory/332-133-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/332-134-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/332-135-0x0000000002300000-0x0000000002306000-memory.dmp

Filesize
24KB

Download
memory/1452-151-0x0000000002150000-0x0000000002156000-memory.dmp

Filesize
24KB

Download
memory/1452-150-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download