Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 03:22
Behavioral task
behavioral1
Sample
02b72f46ffbefe3f47b62cdd7a7c5bdf.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
02b72f46ffbefe3f47b62cdd7a7c5bdf.exe
Resource
win10v2004-20231215-en
General
-
Target
02b72f46ffbefe3f47b62cdd7a7c5bdf.exe
-
Size
15KB
-
MD5
02b72f46ffbefe3f47b62cdd7a7c5bdf
-
SHA1
3daefad01bdcecd37ea32a0c3396c655cb8e5dad
-
SHA256
23a4443a2cc8df68b4b90f5581aff7d4750b1db2aa5dd1822bf31c9243567905
-
SHA512
ab22f740a2b6e810d4083450069a02a7bc1fa540ad93642fca6aac64c7aafd2b4a1d7266095676a3f5171c12b2ce0b70b099d1dd8e62ab5ccab878e7fe2fa2d6
-
SSDEEP
384:xTuJF0BeRm5HdGdrfB+ylNHQbR9uyWcisZsWQwF:xTu/0B5dGpfXP6R9uBR3c
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 02b72f46ffbefe3f47b62cdd7a7c5bdf.exe -
resource yara_rule behavioral2/memory/2544-0-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/2544-15-0x0000000000400000-0x000000000040D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2544 02b72f46ffbefe3f47b62cdd7a7c5bdf.exe 2544 02b72f46ffbefe3f47b62cdd7a7c5bdf.exe 2544 02b72f46ffbefe3f47b62cdd7a7c5bdf.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
487B
MD521bca3406f06003e03614a88b00e0403
SHA1ce0a4cfee50e9ec5887365c17eb51d9837bc5bc2
SHA256d5e818ea15a3cb9f79434b4524b376196c8bc60bb1a9ec3f615d888822cf370e
SHA5126f4391159be9f6a09c34b3261831f0e10dd0dbd595ff0a39b212d4dea80f275c085a9e553add116ad1b131c5667ab60baf823eca12a587deb2cee18e4f930f40