0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560

Analysis

max time kernel
165s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe
Size

199KB
MD5

e9e683d7420031ab88b4b9f1841aef30
SHA1

f796a034a94f5c2e78dfb5445e2cd58ff8b11242
SHA256

0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560
SHA512

5e5fe9ef2234eecd5c5b8a6c814de0b5a2be4e404afcea242fe1412bf73f7fb5bdbc23fcdecab3c37a553f10387b54a3e20dab9f2da8d9f06dd3159be395f65d
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOP:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXK

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe

Executes dropped EXE 1 IoCs

pid	Process
4168	ksqhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\ksqhost.exe	0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe
File opened for modification	C:\Windows\Debug\ksqhost.exe	0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ksqhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ksqhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2948	0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 4540	2948	0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe	87
PID 2948 wrote to memory of 4540	2948	0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe	87
PID 2948 wrote to memory of 4540	2948	0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe	87

C:\Users\Admin\AppData\Local\Temp\0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe
"C:\Users\Admin\AppData\Local\Temp\0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\0BE71F~1.EXE > nul
  2⤵
  PID:4540

C:\Windows\Debug\ksqhost.exe
C:\Windows\Debug\ksqhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\ksqhost.exe

Filesize
199KB

MD5
3904398934388f672f82a2c96c7db801

SHA1
0a6d2a6db4004361fcac9c55e9a6f34c7bdb5386

SHA256
162465bf590af10a0e5f18e7422de1778777791415869f17369c60e83d6389df

SHA512
239b7bf435b476cec5d9a4f55db423eae3586c53ac0491089713a4ebf41390d4e583747cc06c55c8cd3db31094fa82a9e7ba92f904fac019df1ba44684937576

Download Submit
C:\Windows\debug\ksqhost.exe

Filesize
199KB

MD5
3904398934388f672f82a2c96c7db801

SHA1
0a6d2a6db4004361fcac9c55e9a6f34c7bdb5386

SHA256
162465bf590af10a0e5f18e7422de1778777791415869f17369c60e83d6389df

SHA512
239b7bf435b476cec5d9a4f55db423eae3586c53ac0491089713a4ebf41390d4e583747cc06c55c8cd3db31094fa82a9e7ba92f904fac019df1ba44684937576

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads