f170f7d03815cbdc00681d484b53ae2ef5b94327a9648ed4c275ebe9e69e52e6

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f170f7d03815cbdc00681d484b53ae2ef5b94327a9648ed4c275ebe9e69e52e6.exe
Size

1.6MB
MD5

de5908828c6a69018bfbce5e747bff06
SHA1

3fde5014a65a97cf4f92359baaf14b43784404fa
SHA256

f170f7d03815cbdc00681d484b53ae2ef5b94327a9648ed4c275ebe9e69e52e6
SHA512

ea03f824d055b88bd58299a5959143ce63ddbd0a4758849d5d3996f145f532edf341b7503d8649fe84dc52e0930ad5e8d1a5a52fd6ae58c1f5b2950520d944ef
SSDEEP

24576:acbD/31EBoewQOEBs3sEvsx1SGJOrv9mftuF5OloiegCVFeYum9Q:acbz6481x1SxE0UlkJQ5

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation	f170f7d03815cbdc00681d484b53ae2ef5b94327a9648ed4c275ebe9e69e52e6.exe

Loads dropped DLL 1 IoCs

pid	Process
3588	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 3588	1840	f170f7d03815cbdc00681d484b53ae2ef5b94327a9648ed4c275ebe9e69e52e6.exe	83
PID 1840 wrote to memory of 3588	1840	f170f7d03815cbdc00681d484b53ae2ef5b94327a9648ed4c275ebe9e69e52e6.exe	83
PID 1840 wrote to memory of 3588	1840	f170f7d03815cbdc00681d484b53ae2ef5b94327a9648ed4c275ebe9e69e52e6.exe	83

C:\Users\Admin\AppData\Local\Temp\f170f7d03815cbdc00681d484b53ae2ef5b94327a9648ed4c275ebe9e69e52e6.exe
"C:\Users\Admin\AppData\Local\Temp\f170f7d03815cbdc00681d484b53ae2ef5b94327a9648ed4c275ebe9e69e52e6.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" -S FZJvFQ.X -U
  2⤵
  - Loads dropped DLL
  PID:3588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FZJvFQ.X

Filesize
1.4MB

MD5
38b0fea6d7290917b4b87e351476db16

SHA1
a312b384f25dbe7120358e57b382dd9ed0f1e062

SHA256
5b84d664a5891d250d8c075b940f126eb738cd573ecfe39f182841c220c3026a

SHA512
9a3dffccbbe985606ec9d67bf52b6c25d9bb03715626962dded5ae84575404c63091e177b9902eeb602b5fc1a7cddc862822ab05d757d875e2fa2792da468a30

Download Submit
C:\Users\Admin\AppData\Local\Temp\fzjvFq.X

Filesize
1.4MB

MD5
38b0fea6d7290917b4b87e351476db16

SHA1
a312b384f25dbe7120358e57b382dd9ed0f1e062

SHA256
5b84d664a5891d250d8c075b940f126eb738cd573ecfe39f182841c220c3026a

SHA512
9a3dffccbbe985606ec9d67bf52b6c25d9bb03715626962dded5ae84575404c63091e177b9902eeb602b5fc1a7cddc862822ab05d757d875e2fa2792da468a30

Download Submit
memory/3588-4-0x0000000000950000-0x0000000000956000-memory.dmp

Filesize
24KB

Download
memory/3588-5-0x0000000010000000-0x0000000010167000-memory.dmp

Filesize
1.4MB

Download
memory/3588-8-0x00000000024E0000-0x00000000025D7000-memory.dmp

Filesize
988KB

Download
memory/3588-9-0x00000000025E0000-0x00000000026C0000-memory.dmp

Filesize
896KB

Download
memory/3588-12-0x00000000025E0000-0x00000000026C0000-memory.dmp

Filesize
896KB

Download
memory/3588-13-0x00000000025E0000-0x00000000026C0000-memory.dmp

Filesize
896KB

Download