Analysis

  • max time kernel
    0s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-12-2023 17:00

General

  • Target

    2f23b1ab00f70ee0e0d9cbcfe427cb9f.exe

  • Size

    1.0MB

  • MD5

    2f23b1ab00f70ee0e0d9cbcfe427cb9f

  • SHA1

    bcc1e50323641c1a0b7a0e73e12f5a1badf3d797

  • SHA256

    e246202e31ac30137930abb6ce5853b689f39d804b9d7bcb9c11b79e97218e9e

  • SHA512

    2a90e609c6917d5877f28821441f81085b086be34a4fa7495415e11cee1f5a23a02c05e3c1d66b04ea33f6daa1e8d070bada53366931dec1ef7750756c3f8730

  • SSDEEP

    24576:6Av5UFr4ccK1H68NmPUEOgaJVyrRgWvnvk:60kcK1H6umtOryVBk

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f23b1ab00f70ee0e0d9cbcfe427cb9f.exe
    "C:\Users\Admin\AppData\Local\Temp\2f23b1ab00f70ee0e0d9cbcfe427cb9f.exe"
    1⤵
    • Checks computer location settings
    PID:828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/828-0-0x00000000020C0000-0x00000000020C1000-memory.dmp

    Filesize

    4KB

  • memory/828-11-0x0000000000400000-0x0000000000465000-memory.dmp

    Filesize

    404KB