71ead39a9922a0ce8c53dd350367276cc454b353339a15f151450b62cbd34703

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2023, 12:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43ba93e034b678exeexe_JC.exe
Size

30KB
MD5

43ba93e034b678d29726ca1c60400a6a
SHA1

cb68f89ecae0526435cb87676798405bdab3fe8d
SHA256

71ead39a9922a0ce8c53dd350367276cc454b353339a15f151450b62cbd34703
SHA512

7b7e860b5176209428de4c4385bb7d37ce14a51c4d450e33c3e87b515ab53f35a3a55318c1045b764badfe2de3457c73f6816284f697c5fab58fa33a11b22376
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpjRAV/kf:V6QFElP6n+gMQMOtEvwDpjRAV/U

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	43ba93e034b678exeexe_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
464	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 464	4604	43ba93e034b678exeexe_JC.exe	86
PID 4604 wrote to memory of 464	4604	43ba93e034b678exeexe_JC.exe	86
PID 4604 wrote to memory of 464	4604	43ba93e034b678exeexe_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\43ba93e034b678exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\43ba93e034b678exeexe_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
30KB

MD5
e009b7d29fe0ca7bf3559e99da48fdff

SHA1
d79f01b4403f5703eb4325fe0ee6ac42b97fcb34

SHA256
d3b7b0b3b84e88fb29926ea867b9487118f6376fc3be3d3f2ab8ac0dab0d753e

SHA512
611e7bc0059d94dd5cbb0b81d62945336d308776008a2aa84906358ac2738e704375ccaa6e929067d06eabd220d37755a9245738ff0c068711b99d31f56ecdb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
30KB

MD5
e009b7d29fe0ca7bf3559e99da48fdff

SHA1
d79f01b4403f5703eb4325fe0ee6ac42b97fcb34

SHA256
d3b7b0b3b84e88fb29926ea867b9487118f6376fc3be3d3f2ab8ac0dab0d753e

SHA512
611e7bc0059d94dd5cbb0b81d62945336d308776008a2aa84906358ac2738e704375ccaa6e929067d06eabd220d37755a9245738ff0c068711b99d31f56ecdb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
30KB

MD5
e009b7d29fe0ca7bf3559e99da48fdff

SHA1
d79f01b4403f5703eb4325fe0ee6ac42b97fcb34

SHA256
d3b7b0b3b84e88fb29926ea867b9487118f6376fc3be3d3f2ab8ac0dab0d753e

SHA512
611e7bc0059d94dd5cbb0b81d62945336d308776008a2aa84906358ac2738e704375ccaa6e929067d06eabd220d37755a9245738ff0c068711b99d31f56ecdb3

Download Submit
memory/464-150-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/464-151-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/4604-133-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/4604-134-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/4604-135-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download