6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2023, 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe
Size

1.2MB
MD5

30bc3a5f2e0ce39f40fc7b7b8e8579ee
SHA1

0e7ce11e26c8fd9df95127e5d09022ebec85f71c
SHA256

6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e
SHA512

d1fc41e1ae92f49eb61cf89c0cb69cc8aeab2e5709d43101d2e8eb1148d522b295fb59fe98ce7952e503536763e6b7d20ac2c36d310d6665be79e4f009fdb799
SSDEEP

24576:GHXXX/XXXFqIIIcXXX5j2XXXcXXXfXXXxXXXLIII+Ph2kkkkK4kXkkkkkkkkhLXp:G9qIIIUjfIIIAbazR0vKLXZs

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe

Executes dropped EXE 1 IoCs

pid	Process
2212	foohost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\foohost.exe	6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe
File opened for modification	C:\Windows\Debug\foohost.exe	6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	foohost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	foohost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3508	6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 3052	3508	6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe	85
PID 3508 wrote to memory of 3052	3508	6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe	85
PID 3508 wrote to memory of 3052	3508	6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe	85

C:\Users\Admin\AppData\Local\Temp\6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe
"C:\Users\Admin\AppData\Local\Temp\6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6665DE~1.EXE > nul
  2⤵
  PID:3052

C:\Windows\Debug\foohost.exe
C:\Windows\Debug\foohost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\foohost.exe

Filesize
1.2MB

MD5
6eb8fb16ddb7174d506fedf585d94dbf

SHA1
8157d5aa568922194e08f33d225018e59d61d925

SHA256
c8d03b783cbd27e058d198a7c460d78f4ee3e3d8e19734bc4efbef745a80c74f

SHA512
d49c5dfe6620e128fd6ecfb051add8f99b213dfa20fbb6d3e839895c03500c9372f615b00b11bc4bb9cfa9f0090bbcaa85db7afda6863bc82309f8c01d08dce1

Download Submit
C:\Windows\debug\foohost.exe

Filesize
1.2MB

MD5
6eb8fb16ddb7174d506fedf585d94dbf

SHA1
8157d5aa568922194e08f33d225018e59d61d925

SHA256
c8d03b783cbd27e058d198a7c460d78f4ee3e3d8e19734bc4efbef745a80c74f

SHA512
d49c5dfe6620e128fd6ecfb051add8f99b213dfa20fbb6d3e839895c03500c9372f615b00b11bc4bb9cfa9f0090bbcaa85db7afda6863bc82309f8c01d08dce1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads