553fea196ff7de96e07770f58d5a2aada599cd9d180914822064890f58d53e3c

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2023 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5c76ff85e5ae4exe_JC.exe
Size

56KB
MD5

f5c76ff85e5ae4d4f91d664aa0168cce
SHA1

33fa47fa3212c9145aef00186cbeb73ed44f31b4
SHA256

553fea196ff7de96e07770f58d5a2aada599cd9d180914822064890f58d53e3c
SHA512

ba73a4bba0d6857e876138ce73de61809db661e7b7c57c28559fde4f251acc00c66c5c3c16cd663b0c18be2320acc233a6dc0686d6ff28092ad371cb39424b54
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBccD2RuoNmuBLEofF:X6a+SOtEvwDpjBrOd

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation	f5c76ff85e5ae4exe_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
3724	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 3724	1260	f5c76ff85e5ae4exe_JC.exe	84
PID 1260 wrote to memory of 3724	1260	f5c76ff85e5ae4exe_JC.exe	84
PID 1260 wrote to memory of 3724	1260	f5c76ff85e5ae4exe_JC.exe	84

C:\Users\Admin\AppData\Local\Temp\f5c76ff85e5ae4exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\f5c76ff85e5ae4exe_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
56KB

MD5
b1fb0a4f3ea3e547cd1ecf5d63ba4cb5

SHA1
c8ac438ca03ea31a0a582b4b107ddf7d02183f11

SHA256
89989ff2d1e9ad6820c23a743bb78bfafa98aa8f75fd66b30a1e77b643096ccf

SHA512
48a490fad058441f7a178ff8f98697137d20858b79853b75002eb28cd50182f7cdc0a024fdb2759ac16ceafbbe2c78e82edbd2ec4e415e7d09a5e8f744a8ac55

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
56KB

MD5
b1fb0a4f3ea3e547cd1ecf5d63ba4cb5

SHA1
c8ac438ca03ea31a0a582b4b107ddf7d02183f11

SHA256
89989ff2d1e9ad6820c23a743bb78bfafa98aa8f75fd66b30a1e77b643096ccf

SHA512
48a490fad058441f7a178ff8f98697137d20858b79853b75002eb28cd50182f7cdc0a024fdb2759ac16ceafbbe2c78e82edbd2ec4e415e7d09a5e8f744a8ac55

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
56KB

MD5
b1fb0a4f3ea3e547cd1ecf5d63ba4cb5

SHA1
c8ac438ca03ea31a0a582b4b107ddf7d02183f11

SHA256
89989ff2d1e9ad6820c23a743bb78bfafa98aa8f75fd66b30a1e77b643096ccf

SHA512
48a490fad058441f7a178ff8f98697137d20858b79853b75002eb28cd50182f7cdc0a024fdb2759ac16ceafbbe2c78e82edbd2ec4e415e7d09a5e8f744a8ac55

Download Submit
memory/1260-133-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/1260-134-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/1260-135-0x0000000000820000-0x0000000000826000-memory.dmp

Filesize
24KB

Download
memory/3724-150-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/3724-151-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download