4abaf9ad89508803c86cc94d1f9300a68987e63311be3297ad1a68a21dad844f

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17-07-2023 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

988693e8215326_JC.exe
Size

36KB
MD5

988693e82153263e0b67d5ab74f92e0d
SHA1

6a2c40c9c2c98efd3e9a19a4164f70756f728a23
SHA256

4abaf9ad89508803c86cc94d1f9300a68987e63311be3297ad1a68a21dad844f
SHA512

138e12fd8967276e6a48f84a9f9065af9fac6d7b10d49e3deb3072f7b8be2223b32dec823dc2606498cbf771d9514b2e1449794a37e9cdda2256a77f73d1cc9c
SSDEEP

768:q0ZziOWwULueOSdE8tOOtEvwDpjej4AYsqSh+DETkejlsDBQ:q0zizzOSxMOtEvwDpjC39+D+5ZWQ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation	988693e8215326_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
5064	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 5064	4512	988693e8215326_JC.exe	85
PID 4512 wrote to memory of 5064	4512	988693e8215326_JC.exe	85
PID 4512 wrote to memory of 5064	4512	988693e8215326_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\988693e8215326_JC.exe
"C:\Users\Admin\AppData\Local\Temp\988693e8215326_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:5064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
36KB

MD5
b6715658e7900fd45187ec91b93e25f4

SHA1
6dad1051db453d42109aa154bb4071b1eb07e62e

SHA256
40e2a241eb76f38fb89473bdc5f3a12feb92bf56765b9981b90282f22b0162c2

SHA512
f0c32674246c77729cb144a18d93904a723cd4d54f3da63122e5f5bf2031a34527636326660577e3ee817fa4ee26aaa60d02bc324a3b89f43384966ed2abe75b

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
36KB

MD5
b6715658e7900fd45187ec91b93e25f4

SHA1
6dad1051db453d42109aa154bb4071b1eb07e62e

SHA256
40e2a241eb76f38fb89473bdc5f3a12feb92bf56765b9981b90282f22b0162c2

SHA512
f0c32674246c77729cb144a18d93904a723cd4d54f3da63122e5f5bf2031a34527636326660577e3ee817fa4ee26aaa60d02bc324a3b89f43384966ed2abe75b

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
36KB

MD5
b6715658e7900fd45187ec91b93e25f4

SHA1
6dad1051db453d42109aa154bb4071b1eb07e62e

SHA256
40e2a241eb76f38fb89473bdc5f3a12feb92bf56765b9981b90282f22b0162c2

SHA512
f0c32674246c77729cb144a18d93904a723cd4d54f3da63122e5f5bf2031a34527636326660577e3ee817fa4ee26aaa60d02bc324a3b89f43384966ed2abe75b

Download Submit
memory/4512-133-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4512-134-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4512-135-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4512-136-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/4512-150-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/5064-152-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/5064-153-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/5064-159-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download