0faf9f0416075dd9852ab4e2889830ede7a97fbc6bc2bc1f1ab3f71b8bb51989

Analysis

max time kernel
142s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

115a403a52dfae29a5d7b5057cc6270e.exe
Size

115KB
MD5

115a403a52dfae29a5d7b5057cc6270e
SHA1

c13ca5b70499a8434c4f5a6a51564a4ec912dfbe
SHA256

0faf9f0416075dd9852ab4e2889830ede7a97fbc6bc2bc1f1ab3f71b8bb51989
SHA512

bf7c382b3ed1881ae626b23505e8d1cecbfe2c48ccc6e32a08d1d85a39e6b12d0d33ea7e0830a47ff59398a4f25d5e21812166052a24408477415f96707a93ed
SSDEEP

3072:YmpEp9xUWu1gGjXr2vwvEbMps2i/XHCob:YmpPTj7QIpsPZ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	115a403a52dfae29a5d7b5057cc6270e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4596	4184	115a403a52dfae29a5d7b5057cc6270e.exe	91
PID 4184 wrote to memory of 4596	4184	115a403a52dfae29a5d7b5057cc6270e.exe	91
PID 4184 wrote to memory of 4596	4184	115a403a52dfae29a5d7b5057cc6270e.exe	91

C:\Users\Admin\AppData\Local\Temp\115a403a52dfae29a5d7b5057cc6270e.exe
"C:\Users\Admin\AppData\Local\Temp\115a403a52dfae29a5d7b5057cc6270e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Acz..bat" > nul 2> nul
  2⤵
  PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Acz..bat

Filesize
210B

MD5
28387d644cb3963998b61b4f9ce3b6dc

SHA1
448541b115b1c5110a370cb3820a291f3ac82090

SHA256
9ebf60f9392869c9131e267abf257d0888228b36cb57b81c687a6df32b622b80

SHA512
40d811d6a522c3ccef31615ba6eef7dca5d09608ea259e40eeab3fbac8e8bef044295f4c95859c65605dd1a6590f4bbcf38851c63c6945c033befac62015dc06

Download Submit
memory/4184-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4184-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4184-1-0x0000000002850000-0x0000000002868000-memory.dmp

Filesize
96KB

Download
memory/4184-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download