51710ef7314fee8645620d87e09e005c4de895160974f8f98d7bdf79934b5d23

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2023, 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f7a2f95ad112a_JC.exe
Size

90KB
MD5

6f7a2f95ad112a880a08985e40a63578
SHA1

fb4028b94af051a6da7dd157503900987372c00a
SHA256

51710ef7314fee8645620d87e09e005c4de895160974f8f98d7bdf79934b5d23
SHA512

ac49c556fdbc592468a0c0bc475ac1ce5eaf4912bba75c62ce896f0b83717d479095c9d0f60a90b050d273054ea66b5775a3214adf0ebfb1fd4d3484953f8522
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbNcqamvWLmD:V6a+pOtEvwDpjtJ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	6f7a2f95ad112a_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
232	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 232	4168	6f7a2f95ad112a_JC.exe	85
PID 4168 wrote to memory of 232	4168	6f7a2f95ad112a_JC.exe	85
PID 4168 wrote to memory of 232	4168	6f7a2f95ad112a_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\6f7a2f95ad112a_JC.exe
"C:\Users\Admin\AppData\Local\Temp\6f7a2f95ad112a_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
132bcec38c87d8ae6b8b25f285ac44c5

SHA1
1576de1e861dd7f0da19e7e9be95791c42b8cd3c

SHA256
717a4807ec2e68e159d111b797a089635179ca43bd1af31b724b14a29c3e6ee5

SHA512
69c60dadaad7ccea8bca1f81a94d274593c1e61d3e0894a7e64056f4411886c8a62885d61c05c9ceac5b74fc38de8203128b7e22a67f567a9a783c4355c9ee36

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
132bcec38c87d8ae6b8b25f285ac44c5

SHA1
1576de1e861dd7f0da19e7e9be95791c42b8cd3c

SHA256
717a4807ec2e68e159d111b797a089635179ca43bd1af31b724b14a29c3e6ee5

SHA512
69c60dadaad7ccea8bca1f81a94d274593c1e61d3e0894a7e64056f4411886c8a62885d61c05c9ceac5b74fc38de8203128b7e22a67f567a9a783c4355c9ee36

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
132bcec38c87d8ae6b8b25f285ac44c5

SHA1
1576de1e861dd7f0da19e7e9be95791c42b8cd3c

SHA256
717a4807ec2e68e159d111b797a089635179ca43bd1af31b724b14a29c3e6ee5

SHA512
69c60dadaad7ccea8bca1f81a94d274593c1e61d3e0894a7e64056f4411886c8a62885d61c05c9ceac5b74fc38de8203128b7e22a67f567a9a783c4355c9ee36

Download Submit
memory/232-150-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/232-151-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/4168-133-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4168-134-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4168-135-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download