07a375968118ae73b11d60568dbf865a192d8946b2d40f42f6d66e48d9aa5c14

Analysis

max time kernel
143s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2023, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

07a375968118ae73b11d60568dbf865a192d8946b2d40f42f6d66e48d9aa5c14.exe
Size

196KB
MD5

86f541e460af12b51d874dfca94846d9
SHA1

9721ace94f0d0274c3805fa50560eae0453d4faf
SHA256

07a375968118ae73b11d60568dbf865a192d8946b2d40f42f6d66e48d9aa5c14
SHA512

9530af16118d39cfd1149400f9eeb29af10fe29f620b3d6fad075d88c00efbee7411960c9145db38f1e9db9c06dff4a30a8236d4459abbe6ed4fca5157ed14e1
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOe:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXb

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	07a375968118ae73b11d60568dbf865a192d8946b2d40f42f6d66e48d9aa5c14.exe

Executes dropped EXE 1 IoCs

pid	Process
348	foohost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\foohost.exe	07a375968118ae73b11d60568dbf865a192d8946b2d40f42f6d66e48d9aa5c14.exe
File created	C:\Windows\Debug\foohost.exe	07a375968118ae73b11d60568dbf865a192d8946b2d40f42f6d66e48d9aa5c14.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	foohost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	foohost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4732	07a375968118ae73b11d60568dbf865a192d8946b2d40f42f6d66e48d9aa5c14.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 400	4732	07a375968118ae73b11d60568dbf865a192d8946b2d40f42f6d66e48d9aa5c14.exe	92
PID 4732 wrote to memory of 400	4732	07a375968118ae73b11d60568dbf865a192d8946b2d40f42f6d66e48d9aa5c14.exe	92
PID 4732 wrote to memory of 400	4732	07a375968118ae73b11d60568dbf865a192d8946b2d40f42f6d66e48d9aa5c14.exe	92

C:\Users\Admin\AppData\Local\Temp\07a375968118ae73b11d60568dbf865a192d8946b2d40f42f6d66e48d9aa5c14.exe
"C:\Users\Admin\AppData\Local\Temp\07a375968118ae73b11d60568dbf865a192d8946b2d40f42f6d66e48d9aa5c14.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\07A375~1.EXE > nul
  2⤵
  PID:400

C:\Windows\Debug\foohost.exe
C:\Windows\Debug\foohost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\foohost.exe

Filesize
196KB

MD5
968f09849fc0139e951405cc63525a0b

SHA1
0c94c90b59b65094df82c4cd6a6d04ac6d3eaa2a

SHA256
f9f7b8284e408ac919307967c15fd1d3c7e2e6b930c7219c3cc4f706d1012c42

SHA512
6d1a04007d758664962e65afc0eabb6c0ccf08cfca1bc6f0621f005e426d8c9719925e91f1a9cc15a56042aa93c4521a29ad70e2300048406854446be30ef563

Download Submit
C:\Windows\debug\foohost.exe

Filesize
196KB

MD5
968f09849fc0139e951405cc63525a0b

SHA1
0c94c90b59b65094df82c4cd6a6d04ac6d3eaa2a

SHA256
f9f7b8284e408ac919307967c15fd1d3c7e2e6b930c7219c3cc4f706d1012c42

SHA512
6d1a04007d758664962e65afc0eabb6c0ccf08cfca1bc6f0621f005e426d8c9719925e91f1a9cc15a56042aa93c4521a29ad70e2300048406854446be30ef563

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads