12883a6b74728f3b82cba270d64dd5e07c3ae8abf9a32c95926a20514f1db715

Analysis

max time kernel
141s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2023, 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12883a6b74728f3b82cba270d64dd5e07c3ae8abf9a32c95926a20514f1db715.exe
Size

198KB
MD5

8eaad91c1a74feb6626cfc564986a02f
SHA1

f8b705bfa70f0eb9d2cda92c6727b772af5361a4
SHA256

12883a6b74728f3b82cba270d64dd5e07c3ae8abf9a32c95926a20514f1db715
SHA512

8f6e16992730b516e3aef3fc451fefc1de26709a7e451a4c58f2dee620cf58f6a5019e973b86d95bc1853ca139ea97f95112047f64717f14c51c28e8f73965ae
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOc:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXt

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	12883a6b74728f3b82cba270d64dd5e07c3ae8abf9a32c95926a20514f1db715.exe

Executes dropped EXE 1 IoCs

pid	Process
2564	oqchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\oqchost.exe	12883a6b74728f3b82cba270d64dd5e07c3ae8abf9a32c95926a20514f1db715.exe
File opened for modification	C:\Windows\Debug\oqchost.exe	12883a6b74728f3b82cba270d64dd5e07c3ae8abf9a32c95926a20514f1db715.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	oqchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	oqchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1868	12883a6b74728f3b82cba270d64dd5e07c3ae8abf9a32c95926a20514f1db715.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2112	1868	12883a6b74728f3b82cba270d64dd5e07c3ae8abf9a32c95926a20514f1db715.exe	87
PID 1868 wrote to memory of 2112	1868	12883a6b74728f3b82cba270d64dd5e07c3ae8abf9a32c95926a20514f1db715.exe	87
PID 1868 wrote to memory of 2112	1868	12883a6b74728f3b82cba270d64dd5e07c3ae8abf9a32c95926a20514f1db715.exe	87

C:\Users\Admin\AppData\Local\Temp\12883a6b74728f3b82cba270d64dd5e07c3ae8abf9a32c95926a20514f1db715.exe
"C:\Users\Admin\AppData\Local\Temp\12883a6b74728f3b82cba270d64dd5e07c3ae8abf9a32c95926a20514f1db715.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\12883A~1.EXE > nul
  2⤵
  PID:2112

C:\Windows\Debug\oqchost.exe
C:\Windows\Debug\oqchost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\oqchost.exe

Filesize
198KB

MD5
3b5d5a0144fdf43e9f2547ced5cb5fa5

SHA1
71b31270d1bff25ec3cf407e81a8fada90ded874

SHA256
1b6ee35aa1dcb27fc21bf34b451454699f0ab1083f11910e81e044df7ab5a0a6

SHA512
a7dc08397b8b295e560c7dd0d6b7d6a8fa83b02c16502de10395464513481aaac2e0fe4e74f106912479bd35aad2a8fc1d96dc728a61105522d2a2f6366dc20f

Download Submit
C:\Windows\debug\oqchost.exe

Filesize
198KB

MD5
3b5d5a0144fdf43e9f2547ced5cb5fa5

SHA1
71b31270d1bff25ec3cf407e81a8fada90ded874

SHA256
1b6ee35aa1dcb27fc21bf34b451454699f0ab1083f11910e81e044df7ab5a0a6

SHA512
a7dc08397b8b295e560c7dd0d6b7d6a8fa83b02c16502de10395464513481aaac2e0fe4e74f106912479bd35aad2a8fc1d96dc728a61105522d2a2f6366dc20f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads