839e662805115f0caf7322753b49c9864b27d562fdbe329454aa54567bb2ed3e

Analysis

max time kernel
34s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04b17e91f513014084743f8da38f0e21.exe
Size

655KB
MD5

04b17e91f513014084743f8da38f0e21
SHA1

2865ceaee5dc427134925bf2ab05fb9a3f1c63b7
SHA256

839e662805115f0caf7322753b49c9864b27d562fdbe329454aa54567bb2ed3e
SHA512

356529fac3290605e52b24dc6b1d40ec7d2a2fdcc0b625fef5f2a709c8aa6455cc5e97de0089a83a69679873a4ccabaa94f20069d4aac45fee0e770318052ec8
SSDEEP

12288:dslLOaBXHXgWN+LXfWP5VoaPKfcE2OjSTJVZMOvNb/1oLf:kmWN+rWcaPKhmiWNb1oLf

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	04b17e91f513014084743f8da38f0e21.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	04b17e91f513014084743f8da38f0e21.exe

Executes dropped EXE 2 IoCs

pid	Process
4844	unzip.exe
4844	unzip.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1124	04b17e91f513014084743f8da38f0e21.exe
1124	04b17e91f513014084743f8da38f0e21.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1876	1124	04b17e91f513014084743f8da38f0e21.exe	88
PID 1124 wrote to memory of 1876	1124	04b17e91f513014084743f8da38f0e21.exe	88
PID 1876 wrote to memory of 4844	1876	cmd.exe	91
PID 1876 wrote to memory of 4844	1876	cmd.exe	91
PID 1876 wrote to memory of 4844	1876	cmd.exe	91
PID 1124 wrote to memory of 1876	1124	04b17e91f513014084743f8da38f0e21.exe	187
PID 1124 wrote to memory of 1876	1124	04b17e91f513014084743f8da38f0e21.exe	187
PID 1876 wrote to memory of 4844	1876	cmd.exe	190
PID 1876 wrote to memory of 4844	1876	cmd.exe	190
PID 1876 wrote to memory of 4844	1876	cmd.exe	190

C:\Users\Admin\AppData\Local\Temp\04b17e91f513014084743f8da38f0e21.exe
"C:\Users\Admin\AppData\Local\Temp\04b17e91f513014084743f8da38f0e21.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:/Users/Public/Downloads/unzip.exe -o -P Server8888 C:/Users/Public/Downloads/Server.dat -d C:/Users/Public/Downloads
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Users\Public\Downloads\unzip.exe
    C:/Users/Public/Downloads/unzip.exe -o -P Server8888 C:/Users/Public/Downloads/Server.dat -d C:/Users/Public/Downloads
    3⤵
    - Executes dropped EXE
    PID:4844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:1532

C:\Users\Admin\AppData\Local\Temp\04b17e91f513014084743f8da38f0e21.exe
"C:\Users\Admin\AppData\Local\Temp\04b17e91f513014084743f8da38f0e21.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:/Users/Public/Downloads/unzip.exe -o -P Server8888 C:/Users/Public/Downloads/Server.dat -d C:/Users/Public/Downloads
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Users\Public\Downloads\unzip.exe
    C:/Users/Public/Downloads/unzip.exe -o -P Server8888 C:/Users/Public/Downloads/Server.dat -d C:/Users/Public/Downloads
    3⤵
    - Executes dropped EXE
    PID:4844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Downloads\Server.dat

Filesize
231KB

MD5
06851c6576d5c35156edcf2b3372f589

SHA1
54ed2e3a47aca8a2004d67c90093f8bc645ccad1

SHA256
3db08f6f1afe9bab48efef4589435c3a50b1389a5d4d4cd624014dac9c7757aa

SHA512
8451b4fdef570e9b13f6c77ca12497513321543d4085509b57710d1f8822f7d50f99d991f61fd5a0bea89960562c21aca10d4b23ec125ac6ccbada89fa776fa8

Download Submit
C:\Users\Public\Downloads\unzip.exe

Filesize
164KB

MD5
75375c22c72f1beb76bea39c22a1ed68

SHA1
e1652b058195db3f5f754b7ab430652ae04a50b8

SHA256
8d9b5190aace52a1db1ac73a65ee9999c329157c8e88f61a772433323d6b7a4a

SHA512
1b396e78e189185eefb8c6058aa7e6dfe1b8f2dff8babfe4ffbee93805467bf45760eea6efb8d9bb2040d0eaa56841d457b1976dcfe13ed67931ade01419f55a

Download Submit