fd6a275c7f2653cd48de8747df43ef27b982ec593ef91111e99c2c7428b81150

Analysis

max time kernel
153s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2023, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4194efb43c649c35402c655aa5b68650.exe
Size

56KB
MD5

4194efb43c649c35402c655aa5b68650
SHA1

0a934f2740856f328e842f4ae504df5b89fe07b8
SHA256

fd6a275c7f2653cd48de8747df43ef27b982ec593ef91111e99c2c7428b81150
SHA512

c3d3c743dbd272b2f1c2092bbbb121683631b02502fec2d91a19f3a3b97f0004fa51f7c49f0d3eaa44befc4d4d48f607e16f61849682537f480457be0f18d5a6
SSDEEP

768:buNZKMI4rD95SacCkVCykJSCEEB7uJBuFayjK9lPSRiTxoX:qf5jSacZCykcCEEBCJBFySEEoX

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	4194efb43c649c35402c655aa5b68650.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2220	4194efb43c649c35402c655aa5b68650.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 4992	2220	4194efb43c649c35402c655aa5b68650.exe	87
PID 2220 wrote to memory of 4992	2220	4194efb43c649c35402c655aa5b68650.exe	87
PID 2220 wrote to memory of 4992	2220	4194efb43c649c35402c655aa5b68650.exe	87

C:\Users\Admin\AppData\Local\Temp\4194efb43c649c35402c655aa5b68650.exe
"C:\Users\Admin\AppData\Local\Temp\4194efb43c649c35402c655aa5b68650.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4194EF~1.EXE > nul
  2⤵
  PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...