3529e1c7de5322e78cb5f800909893a1c3a48c5d0040dce4aaf616494d470968

Analysis

max time kernel
12s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11627a52190cebb5fd18f641a6789e29.exe
Size

103KB
MD5

11627a52190cebb5fd18f641a6789e29
SHA1

3753fbf0b7eb10f27a1b8f2f42b1031ef5947e31
SHA256

3529e1c7de5322e78cb5f800909893a1c3a48c5d0040dce4aaf616494d470968
SHA512

e622af6fb50aadf2013363335d9523d756d0e4ed231f242388d4a551fa5e9e170ca8a14a2eca607130ece0c7c311d8d7d809504b2947b42a00458aa388e819ad
SSDEEP

1536:CqJW3IBqpAXmqmuyBXSu6omC/w539lGzNP5x2d5shY73Y:dJW38/4EdVGNxxjhYLY

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	11627a52190cebb5fd18f641a6789e29.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\11627a52190cebb5fd18f641a6789e29.exe
"C:\Users\Admin\AppData\Local\Temp\11627a52190cebb5fd18f641a6789e29.exe"
1⤵
- Checks computer location settings
PID:1900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Cbb..bat" > nul 2> nul
  2⤵
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1900-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1900-1-0x00000000009B0000-0x00000000009B9000-memory.dmp

Filesize
36KB

Download
memory/1900-4-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download