3c82fed002c07a5754c06c88f204417c428fc77ef360b05f36bda2d974a8804f

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f713340e3fbe367b4edb2bd4c0c397d.exe
Size

94KB
MD5

6f713340e3fbe367b4edb2bd4c0c397d
SHA1

eaf477ff32dac4e565d62f2f1fd7c1e96e914275
SHA256

3c82fed002c07a5754c06c88f204417c428fc77ef360b05f36bda2d974a8804f
SHA512

408e661d3fce27be7ba3cab2fca5542fd5c8142199206e2d9b390452df03cf9fc5731817900ed7693800ff021cb1bf8b3539eb8b558555d6507922c2a6f3520d
SSDEEP

1536:ffg+M2Y9oH+cpTKeyaI0Z/od8bDbRvU5yYeVYXrgITAGXBB3exYEjpepikFIy:ffgyY9oH+cTKGI0Z/oooeVYXrgI0GXW4

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	6f713340e3fbe367b4edb2bd4c0c397d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 1368	3488	6f713340e3fbe367b4edb2bd4c0c397d.exe	96
PID 3488 wrote to memory of 1368	3488	6f713340e3fbe367b4edb2bd4c0c397d.exe	96
PID 3488 wrote to memory of 1368	3488	6f713340e3fbe367b4edb2bd4c0c397d.exe	96

C:\Users\Admin\AppData\Local\Temp\6f713340e3fbe367b4edb2bd4c0c397d.exe
"C:\Users\Admin\AppData\Local\Temp\6f713340e3fbe367b4edb2bd4c0c397d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Wnj..bat" > nul 2> nul
  2⤵
  PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Wnj..bat

Filesize
210B

MD5
a95901f74ec29bff13e9609b56d3bc92

SHA1
c70725da5a6f24660981548df1604fa538bb491e

SHA256
170499780cecc276c27851e356cca5166a2506ab3fda98912d22b715011d7aed

SHA512
152d9c1d7ac40ec97b1a156dca44b17abf6877c50ce30ddfdca8bb1b33b9227df7ce29d05e60809ca0b5af6d758d637274a6fa95bc6408616a8d35c939c7d530

Download Submit
memory/3488-1-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/3488-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3488-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3488-3-0x0000000000710000-0x000000000072B000-memory.dmp

Filesize
108KB

Download
memory/3488-4-0x0000000000710000-0x000000000072B000-memory.dmp

Filesize
108KB

Download
memory/3488-6-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download