7de519f83fe48681a7c17c868c8d9c7db533904b54b48517218de458ba15d842

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

276c48503f698413f7366d9728b78ddf.exe
Size

159KB
MD5

276c48503f698413f7366d9728b78ddf
SHA1

9b48ee94af79d37ce11e60069e114940bfadabc0
SHA256

7de519f83fe48681a7c17c868c8d9c7db533904b54b48517218de458ba15d842
SHA512

2a57b017abfb1d9d9d407f50c07a76524b3b1d0b1fe252faa15981416d725c107af394d4b2424c6c86cede93a55cc45f84d399e832b40472d069062121cf7077
SSDEEP

3072:IXbYCtTUzUxIsAQihedBZF9U+5JWu7l5Tk:4UCtTUzNsHdBZ95J/l6

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4660	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	276c48503f698413f7366d9728b78ddf.exe

Executes dropped EXE 1 IoCs

pid	Process
4584	explorer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Help\explorer.exe	276c48503f698413f7366d9728b78ddf.exe
File opened for modification	C:\Windows\Help\explorer.exe	276c48503f698413f7366d9728b78ddf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe
4468	276c48503f698413f7366d9728b78ddf.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4660	4468	276c48503f698413f7366d9728b78ddf.exe	111
PID 4468 wrote to memory of 4660	4468	276c48503f698413f7366d9728b78ddf.exe	111
PID 4468 wrote to memory of 4660	4468	276c48503f698413f7366d9728b78ddf.exe	111
PID 4468 wrote to memory of 4584	4468	276c48503f698413f7366d9728b78ddf.exe	113
PID 4468 wrote to memory of 4584	4468	276c48503f698413f7366d9728b78ddf.exe	113
PID 4468 wrote to memory of 4584	4468	276c48503f698413f7366d9728b78ddf.exe	113

C:\Users\Admin\AppData\Local\Temp\276c48503f698413f7366d9728b78ddf.exe
"C:\Users\Admin\AppData\Local\Temp\276c48503f698413f7366d9728b78ddf.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set allowedprogram program = "C:\Windows\Help\explorer.exe" name = "Explorer" mode = ENABLE scope = ALL profile = ALL
  2⤵
  - Modifies Windows Firewall
  PID:4660
- C:\Windows\Help\explorer.exe
  "C:\Windows\Help\explorer.exe" C:\noexistfile.txt
  2⤵
  - Executes dropped EXE
  PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Help\explorer.exe

Filesize
159KB

MD5
276c48503f698413f7366d9728b78ddf

SHA1
9b48ee94af79d37ce11e60069e114940bfadabc0

SHA256
7de519f83fe48681a7c17c868c8d9c7db533904b54b48517218de458ba15d842

SHA512
2a57b017abfb1d9d9d407f50c07a76524b3b1d0b1fe252faa15981416d725c107af394d4b2424c6c86cede93a55cc45f84d399e832b40472d069062121cf7077

Download Submit
memory/4468-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4468-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download