15bdb05f216e0cbcdb01eb52a3caec0c8b207230d0346d3b414207fb67b7d2a7

Analysis

max time kernel
143s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15bdb05f216e0cbcdb01eb52a3caec0c8b207230d0346d3b414207fb67b7d2a7.exe
Size

198KB
MD5

ac92a45da09f80739641887350c6e082
SHA1

50c4d268189767e0cb26c13d65132ae34357c9ae
SHA256

15bdb05f216e0cbcdb01eb52a3caec0c8b207230d0346d3b414207fb67b7d2a7
SHA512

aa54e70139136e7b46b18023488f456af20e906d3eb072c3898b4d363fa4b8715165db5d1951e22abce1a0aeae01710bdc58303002831906e1a6338d19f123a4
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOI:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXV

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	15bdb05f216e0cbcdb01eb52a3caec0c8b207230d0346d3b414207fb67b7d2a7.exe

Executes dropped EXE 1 IoCs

pid	Process
5088	igkhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\igkhost.exe	15bdb05f216e0cbcdb01eb52a3caec0c8b207230d0346d3b414207fb67b7d2a7.exe
File opened for modification	C:\Windows\Debug\igkhost.exe	15bdb05f216e0cbcdb01eb52a3caec0c8b207230d0346d3b414207fb67b7d2a7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	igkhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	igkhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4480	15bdb05f216e0cbcdb01eb52a3caec0c8b207230d0346d3b414207fb67b7d2a7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 460	4480	15bdb05f216e0cbcdb01eb52a3caec0c8b207230d0346d3b414207fb67b7d2a7.exe	85
PID 4480 wrote to memory of 460	4480	15bdb05f216e0cbcdb01eb52a3caec0c8b207230d0346d3b414207fb67b7d2a7.exe	85
PID 4480 wrote to memory of 460	4480	15bdb05f216e0cbcdb01eb52a3caec0c8b207230d0346d3b414207fb67b7d2a7.exe	85

C:\Users\Admin\AppData\Local\Temp\15bdb05f216e0cbcdb01eb52a3caec0c8b207230d0346d3b414207fb67b7d2a7.exe
"C:\Users\Admin\AppData\Local\Temp\15bdb05f216e0cbcdb01eb52a3caec0c8b207230d0346d3b414207fb67b7d2a7.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\15BDB0~1.EXE > nul
  2⤵
  PID:460

C:\Windows\Debug\igkhost.exe
C:\Windows\Debug\igkhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\igkhost.exe

Filesize
198KB

MD5
c897894197065ceaa0bdb4c7ea0d557f

SHA1
3f4689d96e1b84f1f1fb5a14912b9da98b9e7ca0

SHA256
23662b1fcb36ddd8854971922c883b267c691d1e760484bfcb7dbe2d09f81b6d

SHA512
06f2d7dca504f735317552e30f744d4f532b15d2dd5663f3b01e9cfeaf2efc850b8afbd4e2ec8192ad765445783ad73f4400e335b8a0f6bf29fab70bc45f4c26

Download Submit
C:\Windows\debug\igkhost.exe

Filesize
198KB

MD5
c897894197065ceaa0bdb4c7ea0d557f

SHA1
3f4689d96e1b84f1f1fb5a14912b9da98b9e7ca0

SHA256
23662b1fcb36ddd8854971922c883b267c691d1e760484bfcb7dbe2d09f81b6d

SHA512
06f2d7dca504f735317552e30f744d4f532b15d2dd5663f3b01e9cfeaf2efc850b8afbd4e2ec8192ad765445783ad73f4400e335b8a0f6bf29fab70bc45f4c26

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads