02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11

Analysis

max time kernel
136s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230824-en
resource tags

arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
submitted
31-08-2023 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe
Size

1.2MB
MD5

596ebe8fe69fc0cb8935845fe913550f
SHA1

f39a2929bad8f89a357a5dc53ee5b49d61de3541
SHA256

02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11
SHA512

58230134aa8f796ae34628ff65a89ee4c17236ee725112b8a6883485f814582afdbffbf22799808cd2a819dc915d1596d45999bfa2df2afe15bde3369d0c09ec
SSDEEP

24576:GgZXoZUTVdt7KzkmTWLUSTMyyNdwMWxzN+wyuk7gAPTWMinCTd5hxIuRMFEoI:dvmqdTMnNdsEwyuk7j7WDCTTosMFrI

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Control Panel\International\Geo\Nation	02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe

Executes dropped EXE 1 IoCs

pid	Process
3448	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3448	svchost.exe
3448	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 3448	3268	02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe	87
PID 3268 wrote to memory of 3448	3268	02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe	87
PID 3268 wrote to memory of 3448	3268	02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe	87

C:\Users\Admin\AppData\Local\Temp\02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe
"C:\Users\Admin\AppData\Local\Temp\02c6cfb293130a4d077b411eae8f5e1b2d7e3052d6e51b8bf12ad1becfd75e11.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3268
- C:\ProgramData\yeji\svchost.exe
  "C:\ProgramData\yeji\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\yeji\svchost.exe

Filesize
815KB

MD5
cca2156349a58b04703bd0b11d77438e

SHA1
ffb7ff724e517212f6e461b6ed91dd01cd9fd26c

SHA256
d9a1ca5ddf1fc668947479d5ec2a2d5cff7967ba81b814b6d5ca3cf9ad4ef3c8

SHA512
70d6abd4fbdb4f72f5ec2f771fa4049bf3ae314e9875ea0feff2024990622f7beb0ceeb8a160019587beed8db0c4afd0a47d44f9b275fb9f06399c42f9c8589a

Download Submit
C:\ProgramData\yeji\svchost.exe

Filesize
815KB

MD5
cca2156349a58b04703bd0b11d77438e

SHA1
ffb7ff724e517212f6e461b6ed91dd01cd9fd26c

SHA256
d9a1ca5ddf1fc668947479d5ec2a2d5cff7967ba81b814b6d5ca3cf9ad4ef3c8

SHA512
70d6abd4fbdb4f72f5ec2f771fa4049bf3ae314e9875ea0feff2024990622f7beb0ceeb8a160019587beed8db0c4afd0a47d44f9b275fb9f06399c42f9c8589a

Download Submit
C:\ProgramData\yeji\svchost.exe

Filesize
815KB

MD5
cca2156349a58b04703bd0b11d77438e

SHA1
ffb7ff724e517212f6e461b6ed91dd01cd9fd26c

SHA256
d9a1ca5ddf1fc668947479d5ec2a2d5cff7967ba81b814b6d5ca3cf9ad4ef3c8

SHA512
70d6abd4fbdb4f72f5ec2f771fa4049bf3ae314e9875ea0feff2024990622f7beb0ceeb8a160019587beed8db0c4afd0a47d44f9b275fb9f06399c42f9c8589a

Download Submit
C:\ProgramData\yeji\tc_config.ini

Filesize
135B

MD5
e769f8a5cd673b266b7943f7c14b5870

SHA1
fbebe45df30d15a4aa4454733620cec115c21096

SHA256
ff2f3a5e2b2e1527d4bbdbc234d051c95ba733fc13ae3be1846f3679fe5d1395

SHA512
0e8b56538e2805270c79ed84a41b036344b8842af10f627d514a62a51753b5d69bd9486945a115cf2ee7af375a20f3c13e6d1aff1ff2b49929b95722d0baee83

Download Submit