afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe
Size

199KB
MD5

bde51f3296a69762510b91c144cae2da
SHA1

4f42c625e0befa5a89a44aae7974069198372dac
SHA256

afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b
SHA512

7135b78931d989fe4ebcf6f1a83563dcde2a376b57990925e3e2d4a390869819cd38ab34e1882092091485e582d10ec4edd0420dd754a867158c9ac72f01b617
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCO4:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXZ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation	afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe

Executes dropped EXE 1 IoCs

pid	Process
1120	hauhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\hauhost.exe	afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe
File opened for modification	C:\Windows\Debug\hauhost.exe	afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	hauhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	hauhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2452	afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 4576	2452	afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe	92
PID 2452 wrote to memory of 4576	2452	afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe	92
PID 2452 wrote to memory of 4576	2452	afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe	92

C:\Users\Admin\AppData\Local\Temp\afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe
"C:\Users\Admin\AppData\Local\Temp\afe94c8a2c3f6ff71742187be28e3e2c8561700d383efa853adcdab48229eb7b.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AFE94C~1.EXE > nul
  2⤵
  PID:4576

C:\Windows\Debug\hauhost.exe
C:\Windows\Debug\hauhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\hauhost.exe

Filesize
200KB

MD5
db63a64fd2d71d5bc7c4c2108d0eec9e

SHA1
e24f8544f439b76c71be72cc7b99fd5394659d61

SHA256
e858bfb2020fa9e8454d53de45a537865a679acb0a56c206798a5e513d500e6f

SHA512
d6b5821260040b49513da4a114ac8f2d74ee6d34c7548722e445b4c1a04de2d638006ea63cc830703444f87e071c88e61625b2df1f68b8ad0c05cb15e534fe1a

Download Submit
C:\Windows\debug\hauhost.exe

Filesize
200KB

MD5
db63a64fd2d71d5bc7c4c2108d0eec9e

SHA1
e24f8544f439b76c71be72cc7b99fd5394659d61

SHA256
e858bfb2020fa9e8454d53de45a537865a679acb0a56c206798a5e513d500e6f

SHA512
d6b5821260040b49513da4a114ac8f2d74ee6d34c7548722e445b4c1a04de2d638006ea63cc830703444f87e071c88e61625b2df1f68b8ad0c05cb15e534fe1a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads