22757d47f38b1a0b723ebfc240b8a4fcf0ef531fb9c9f9fba0b5ce3bb4b46247

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2023, 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e54e56b1fb8c9fexe_JC.exe
Size

42KB
MD5

e54e56b1fb8c9fc4aafef77e3c9cdfd2
SHA1

76ca6cb90b468c0cf5341cf18530f51562fdce89
SHA256

22757d47f38b1a0b723ebfc240b8a4fcf0ef531fb9c9f9fba0b5ce3bb4b46247
SHA512

28e3b52d39ce5905cdca8cf89f87752a295b9f5c58b9e7da324f8a0da3e2cd6808d812419cf3f76618d4aaed77a86e5bd2f80ba880f8889698a0bb003203d0bd
SSDEEP

384:e/4wODQkzonAYsju5N/surDQtOOtEvwDpjqIGROqS/W/rJ+xLrs7cwcx4MQ:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8Q

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation	e54e56b1fb8c9fexe_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
2540	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 2540	3924	e54e56b1fb8c9fexe_JC.exe	85
PID 3924 wrote to memory of 2540	3924	e54e56b1fb8c9fexe_JC.exe	85
PID 3924 wrote to memory of 2540	3924	e54e56b1fb8c9fexe_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\e54e56b1fb8c9fexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\e54e56b1fb8c9fexe_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
42KB

MD5
86d19d71fef2c121d554cbc472de6820

SHA1
f24c76324c2858a59309b9f295ba9c45d5271962

SHA256
d96c93b5d3712578f2fd3ecb36e3c9914ea100372e0c70bc5c9d9ebc168028a0

SHA512
d4ddab81c08cc603f1284f280a72de8b825f13d547286fbd6aa9d17ecc7cbad9106da5c1d3e671c45ad2fc0ef6d064195f00b531198771af6d949292b517df64

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
42KB

MD5
86d19d71fef2c121d554cbc472de6820

SHA1
f24c76324c2858a59309b9f295ba9c45d5271962

SHA256
d96c93b5d3712578f2fd3ecb36e3c9914ea100372e0c70bc5c9d9ebc168028a0

SHA512
d4ddab81c08cc603f1284f280a72de8b825f13d547286fbd6aa9d17ecc7cbad9106da5c1d3e671c45ad2fc0ef6d064195f00b531198771af6d949292b517df64

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
42KB

MD5
86d19d71fef2c121d554cbc472de6820

SHA1
f24c76324c2858a59309b9f295ba9c45d5271962

SHA256
d96c93b5d3712578f2fd3ecb36e3c9914ea100372e0c70bc5c9d9ebc168028a0

SHA512
d4ddab81c08cc603f1284f280a72de8b825f13d547286fbd6aa9d17ecc7cbad9106da5c1d3e671c45ad2fc0ef6d064195f00b531198771af6d949292b517df64

Download Submit
memory/2540-152-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/2540-153-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/2540-159-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3924-133-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3924-134-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/3924-135-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/3924-136-0x0000000000540000-0x0000000000546000-memory.dmp

Filesize
24KB

Download
memory/3924-150-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download