369026ec14c5b36a4a4dc24088cb66c2c069f877dc9490879b86d56de7186751

Analysis

max time kernel
141s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2023, 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

369026ec14c5b36a4a4dc24088cb66c2c069f877dc9490879b86d56de7186751.exe
Size

193KB
MD5

fcc53520b179ba8f21b9607573012bc6
SHA1

c0bd006d5e8632b8f810de4502e48726e0d2c029
SHA256

369026ec14c5b36a4a4dc24088cb66c2c069f877dc9490879b86d56de7186751
SHA512

6d0c707890dd514a5113b55ef5e0ad77b37f0e8819985957f327ed82c28766c91e879aedd0187eb21662761c02a569e7e0386e5ad87498b04036b01942faf56f
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCO9:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXc

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation	369026ec14c5b36a4a4dc24088cb66c2c069f877dc9490879b86d56de7186751.exe

Executes dropped EXE 1 IoCs

pid	Process
2604	buchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\buchost.exe	369026ec14c5b36a4a4dc24088cb66c2c069f877dc9490879b86d56de7186751.exe
File opened for modification	C:\Windows\Debug\buchost.exe	369026ec14c5b36a4a4dc24088cb66c2c069f877dc9490879b86d56de7186751.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	buchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	buchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2352	369026ec14c5b36a4a4dc24088cb66c2c069f877dc9490879b86d56de7186751.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1616	2352	369026ec14c5b36a4a4dc24088cb66c2c069f877dc9490879b86d56de7186751.exe	81
PID 2352 wrote to memory of 1616	2352	369026ec14c5b36a4a4dc24088cb66c2c069f877dc9490879b86d56de7186751.exe	81
PID 2352 wrote to memory of 1616	2352	369026ec14c5b36a4a4dc24088cb66c2c069f877dc9490879b86d56de7186751.exe	81

C:\Users\Admin\AppData\Local\Temp\369026ec14c5b36a4a4dc24088cb66c2c069f877dc9490879b86d56de7186751.exe
"C:\Users\Admin\AppData\Local\Temp\369026ec14c5b36a4a4dc24088cb66c2c069f877dc9490879b86d56de7186751.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\369026~1.EXE > nul
  2⤵
  PID:1616

C:\Windows\Debug\buchost.exe
C:\Windows\Debug\buchost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\buchost.exe

Filesize
193KB

MD5
fae5900d3c03ae504b53c0efec4fde1f

SHA1
2b1ac13d9e6ec1e5c53a25216ed59e46fc4233ba

SHA256
f12bb08042f36cda5fabebccdb1e89535c4d20643bbbbf368a02dc288a0a8a1f

SHA512
bcf6fc083d36e7b8ae378614b7a91b5cf768c245a2f3a96876806dc8f83a0a2d4067ffc42cedc88b2e82b1d35ad0676da4390a9a0528a8460cb407ba934e10f4

Download Submit
C:\Windows\debug\buchost.exe

Filesize
193KB

MD5
fae5900d3c03ae504b53c0efec4fde1f

SHA1
2b1ac13d9e6ec1e5c53a25216ed59e46fc4233ba

SHA256
f12bb08042f36cda5fabebccdb1e89535c4d20643bbbbf368a02dc288a0a8a1f

SHA512
bcf6fc083d36e7b8ae378614b7a91b5cf768c245a2f3a96876806dc8f83a0a2d4067ffc42cedc88b2e82b1d35ad0676da4390a9a0528a8460cb407ba934e10f4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads