b86826c30b867d1c18cbcfd7ac19fcf401b2ec36eea641b98aaf0156706ab133

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2023, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2e78361568544_JC.exe
Size

35KB
MD5

c2e783615685445e58944bf183ffa6a6
SHA1

76c7d5773e8c20171469357aedf4d4a179a9b774
SHA256

b86826c30b867d1c18cbcfd7ac19fcf401b2ec36eea641b98aaf0156706ab133
SHA512

0e69cb8c1260fbaadd137159c7043adf41dd171fc009050646548de925970cf99f643fc69da03d242e90738ce0bb8b182101719516cc500be6c8d6542b47a95d
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf6XT+0vJsg5b5Usr:bgX4zYcgTEu6QOaryfjqDlC6JFbK4

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation	c2e78361568544_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
3724	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 3724	4516	c2e78361568544_JC.exe	86
PID 4516 wrote to memory of 3724	4516	c2e78361568544_JC.exe	86
PID 4516 wrote to memory of 3724	4516	c2e78361568544_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\c2e78361568544_JC.exe
"C:\Users\Admin\AppData\Local\Temp\c2e78361568544_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:3724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
35KB

MD5
a307cc07af13370bd4f34fb95bb8931a

SHA1
184d11b2b033bb1a84a46e01111bd361b0590431

SHA256
b42f51ff91bb676afa3bbae36ef9395067a21999bfe69c37ccbca4ed852cd049

SHA512
ccd0b24ade17ef7726276a35d4c89f135f0edca35e30acc5ae769d02656c387c55fd4690941d070832d8f4548e27e5264d5b0eba47a6d6c6c336eebda40d4475

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
35KB

MD5
a307cc07af13370bd4f34fb95bb8931a

SHA1
184d11b2b033bb1a84a46e01111bd361b0590431

SHA256
b42f51ff91bb676afa3bbae36ef9395067a21999bfe69c37ccbca4ed852cd049

SHA512
ccd0b24ade17ef7726276a35d4c89f135f0edca35e30acc5ae769d02656c387c55fd4690941d070832d8f4548e27e5264d5b0eba47a6d6c6c336eebda40d4475

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
35KB

MD5
a307cc07af13370bd4f34fb95bb8931a

SHA1
184d11b2b033bb1a84a46e01111bd361b0590431

SHA256
b42f51ff91bb676afa3bbae36ef9395067a21999bfe69c37ccbca4ed852cd049

SHA512
ccd0b24ade17ef7726276a35d4c89f135f0edca35e30acc5ae769d02656c387c55fd4690941d070832d8f4548e27e5264d5b0eba47a6d6c6c336eebda40d4475

Download Submit
memory/3724-150-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/3724-151-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/4516-133-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4516-134-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4516-135-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download