c6ef385a22a31e640b27c99e820e5ae0a188ebad56e34a9d42df3bb2ecf8cefd

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2023 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f40795eb5d7c50exe_JC.exe
Size

137KB
MD5

f40795eb5d7c50dafc23b92153f3db18
SHA1

d05fe3a4be15d73db8b1f3fc65091cb18f184a87
SHA256

c6ef385a22a31e640b27c99e820e5ae0a188ebad56e34a9d42df3bb2ecf8cefd
SHA512

aa10d1f7802c7ace0cf2ddb106f8fc98fc6f61aed477da77e80c3632378975244d823b8274a7191fb3536b7c7e1f4c668c26600773b79e02d70e2e68b183df15
SSDEEP

1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp699G/TGuv1:z6a+CdOOtEvwDpjczK

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation	f40795eb5d7c50exe_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
1712	asih.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4796-133-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x0003000000015cff-146.dat	upx
behavioral2/files/0x0003000000015cff-148.dat	upx
behavioral2/files/0x0003000000015cff-149.dat	upx
behavioral2/memory/4796-150-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1712-159-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 1712	4796	f40795eb5d7c50exe_JC.exe	87
PID 4796 wrote to memory of 1712	4796	f40795eb5d7c50exe_JC.exe	87
PID 4796 wrote to memory of 1712	4796	f40795eb5d7c50exe_JC.exe	87

C:\Users\Admin\AppData\Local\Temp\f40795eb5d7c50exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\f40795eb5d7c50exe_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
137KB

MD5
4b82735a3638cd72cc13881a96e3f4fb

SHA1
1fc798a515f9e769a1693493c1eff0cdee07cae2

SHA256
71e38ef28a3e2f9acb6fabe40fef90cc172b63cc20d216e50aee800a038d10d1

SHA512
5f8259966932bfe1872c75751170109e65f010fa4d485e5d3c133e8cf03797653896b9b6369b0355e31de0b7c64527be537b06f11ebe4c3dabefc02d3167adf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
137KB

MD5
4b82735a3638cd72cc13881a96e3f4fb

SHA1
1fc798a515f9e769a1693493c1eff0cdee07cae2

SHA256
71e38ef28a3e2f9acb6fabe40fef90cc172b63cc20d216e50aee800a038d10d1

SHA512
5f8259966932bfe1872c75751170109e65f010fa4d485e5d3c133e8cf03797653896b9b6369b0355e31de0b7c64527be537b06f11ebe4c3dabefc02d3167adf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
137KB

MD5
4b82735a3638cd72cc13881a96e3f4fb

SHA1
1fc798a515f9e769a1693493c1eff0cdee07cae2

SHA256
71e38ef28a3e2f9acb6fabe40fef90cc172b63cc20d216e50aee800a038d10d1

SHA512
5f8259966932bfe1872c75751170109e65f010fa4d485e5d3c133e8cf03797653896b9b6369b0355e31de0b7c64527be537b06f11ebe4c3dabefc02d3167adf5

Download Submit
memory/1712-152-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1712-153-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/1712-159-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4796-133-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4796-134-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/4796-135-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/4796-136-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/4796-150-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download