306be0c3019ea54c53df124f0817b65c440d8732f7c0ab7acf1ec06ee83b9f21

Analysis

max time kernel
168s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

306be0c3019ea54c53df124f0817b65c440d8732f7c0ab7acf1ec06ee83b9f21.exe
Size

198KB
MD5

b6d5d2be416d49e39c063d9a5764dd8a
SHA1

ab76ff11471a1babee9994feb5a520e483cbdd43
SHA256

306be0c3019ea54c53df124f0817b65c440d8732f7c0ab7acf1ec06ee83b9f21
SHA512

0198a6077d884f61a7ba4260b5d194f571501db1452f30d1fd357570f10856326454efbd16ae0f37d4060e00ef3439d9ea0926ec35d97290603e505f343bfdf1
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOA:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXt

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	306be0c3019ea54c53df124f0817b65c440d8732f7c0ab7acf1ec06ee83b9f21.exe

Executes dropped EXE 1 IoCs

pid	Process
1132	igkhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\igkhost.exe	306be0c3019ea54c53df124f0817b65c440d8732f7c0ab7acf1ec06ee83b9f21.exe
File opened for modification	C:\Windows\Debug\igkhost.exe	306be0c3019ea54c53df124f0817b65c440d8732f7c0ab7acf1ec06ee83b9f21.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	igkhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	igkhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4424	306be0c3019ea54c53df124f0817b65c440d8732f7c0ab7acf1ec06ee83b9f21.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 1852	4424	306be0c3019ea54c53df124f0817b65c440d8732f7c0ab7acf1ec06ee83b9f21.exe	88
PID 4424 wrote to memory of 1852	4424	306be0c3019ea54c53df124f0817b65c440d8732f7c0ab7acf1ec06ee83b9f21.exe	88
PID 4424 wrote to memory of 1852	4424	306be0c3019ea54c53df124f0817b65c440d8732f7c0ab7acf1ec06ee83b9f21.exe	88

C:\Users\Admin\AppData\Local\Temp\306be0c3019ea54c53df124f0817b65c440d8732f7c0ab7acf1ec06ee83b9f21.exe
"C:\Users\Admin\AppData\Local\Temp\306be0c3019ea54c53df124f0817b65c440d8732f7c0ab7acf1ec06ee83b9f21.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\306BE0~1.EXE > nul
  2⤵
  PID:1852

C:\Windows\Debug\igkhost.exe
C:\Windows\Debug\igkhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\igkhost.exe

Filesize
198KB

MD5
1253dce9754f5c2dc1ded0a10e0cb4d0

SHA1
5ba59cd04dc283cc7d778b0bb339a4e5a0242543

SHA256
ea5b29064f553de636bb6657aa2576499cfba42f34694e134cdfa84ab574c4c2

SHA512
60a6745ba099510c7df2b9b0e4565917aee93bd906c72ab70c540aa59e30333d44fd75b783c629566fd09051dcfa776bfb0f88b2c1aea262c4f81be9be7f5930

Download Submit
C:\Windows\debug\igkhost.exe

Filesize
198KB

MD5
1253dce9754f5c2dc1ded0a10e0cb4d0

SHA1
5ba59cd04dc283cc7d778b0bb339a4e5a0242543

SHA256
ea5b29064f553de636bb6657aa2576499cfba42f34694e134cdfa84ab574c4c2

SHA512
60a6745ba099510c7df2b9b0e4565917aee93bd906c72ab70c540aa59e30333d44fd75b783c629566fd09051dcfa776bfb0f88b2c1aea262c4f81be9be7f5930

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads