07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9

Analysis

max time kernel
151s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe
Size

8.7MB
MD5

d2f0b31814de49e311ce5dbc6b99d096
SHA1

9cc372b964ffd717d9d206c78700bbc084e9a254
SHA256

07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9
SHA512

92e73bb62309988fd5b792ff267b37e6aa5bdb7443d7909f04011d6dc16437bcb453678de965e25f2c0c5541108411deb936055b8350fa285a38b2eebebb3125
SSDEEP

196608:kgwX9zd+In2r3IcI9MtgrrH8zWil3QipP:k7eInPwK8zBBR

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe

Executes dropped EXE 1 IoCs

pid	Process
1276	HardWare_QC_UFS_TOOLS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1148	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe
1148	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe
1148	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe
1148	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1148	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe
1148	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 1276	1148	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe	87
PID 1148 wrote to memory of 1276	1148	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe	87
PID 1148 wrote to memory of 1276	1148	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe	87
PID 1148 wrote to memory of 1276	1148	07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe	87

C:\Users\Admin\AppData\Local\Temp\07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe
"C:\Users\Admin\AppData\Local\Temp\07eb2f54ad6910071c17ec899bb151f7e174cfaf94f54f5d8f8d08131bfe75d9.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Local\Temp\HardWare_QC_UFS_TOOLS.exe
  "C:\Users\Admin\AppData\Local\Temp\HardWare_QC_UFS_TOOLS.exe"
  2⤵
  - Executes dropped EXE
  PID:1276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HardWare_QC_UFS_TOOLS.exe

Filesize
7.0MB

MD5
baf72adce67a01875a3d16ed8bc36859

SHA1
0877d9bb86afa76308b9c93501efd10f45b83491

SHA256
9d45653a9f5276d42fa8c3770156890cd7e2e6e3d2f9366dd01654017dd799c3

SHA512
881dac92f8084eb71f8556658817b1eeed74dc04a4843fc8ff24fb5fddded72e8c114ee40de00fa541b9bdad7b2b0cb135624428d1ca85b58a8bc96fb65e3adc

Download Submit
C:\Users\Admin\AppData\Local\Temp\HardWare_QC_UFS_TOOLS.exe

Filesize
7.0MB

MD5
baf72adce67a01875a3d16ed8bc36859

SHA1
0877d9bb86afa76308b9c93501efd10f45b83491

SHA256
9d45653a9f5276d42fa8c3770156890cd7e2e6e3d2f9366dd01654017dd799c3

SHA512
881dac92f8084eb71f8556658817b1eeed74dc04a4843fc8ff24fb5fddded72e8c114ee40de00fa541b9bdad7b2b0cb135624428d1ca85b58a8bc96fb65e3adc

Download Submit
memory/1276-11-0x0000000000400000-0x0000000000E89000-memory.dmp

Filesize
10.5MB

Download