42f1466e480f36b83f367e26010bdc1376f7fd09485849945401f51d5c21d8e9

Analysis

max time kernel
160s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02a5c26481aa82d85f04ba6d97f53fe6.exe
Size

36KB
MD5

02a5c26481aa82d85f04ba6d97f53fe6
SHA1

ae950032edb089f7c73ddfdf13f23e24a04702dd
SHA256

42f1466e480f36b83f367e26010bdc1376f7fd09485849945401f51d5c21d8e9
SHA512

63623f3195d13aa51e153a375f81bbf7e92164fa902875e4fff6d9b8422fcff9c8c1e0d2c35d1429d5d0a69ff425a656953830d4221513488856737abefe9ee8
SSDEEP

384:R4n1dWgsWIcUAewcDdDUD4QvSeOSgk/UZRe4xDpGkaV3gTGPz5S6ihTuXo2dsGLN:K77V7LUZQEpTDxNflPZscjS55DHy0

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	02a5c26481aa82d85f04ba6d97f53fe6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2356	02a5c26481aa82d85f04ba6d97f53fe6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1876	2356	02a5c26481aa82d85f04ba6d97f53fe6.exe	94
PID 2356 wrote to memory of 1876	2356	02a5c26481aa82d85f04ba6d97f53fe6.exe	94
PID 2356 wrote to memory of 1876	2356	02a5c26481aa82d85f04ba6d97f53fe6.exe	94

C:\Users\Admin\AppData\Local\Temp\02a5c26481aa82d85f04ba6d97f53fe6.exe
"C:\Users\Admin\AppData\Local\Temp\02a5c26481aa82d85f04ba6d97f53fe6.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4487.bat" "
  2⤵
  PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4487.bat

Filesize
299B

MD5
f4b33f94f4b2ccd3b4db7a8e3a6d4999

SHA1
0b907087e9cac5497105ef8c8fe1cd9c61151414

SHA256
4464c889fca0767c0ffc555bc1be7f17ddb7edeefc6cef8091fd1ca7e7333eee

SHA512
b04f4c411ea058db235503e2b6d57784b5bb48370675b7c163fe77637929ee76e225a012db1bbc83b09efc32d87ab909819bd7f3c4cb86e41cd71dae66037ceb

Download Submit