9be24b5620f91a390cec4c24d6b418366c6cb917f81d4fcb39ac1b7dafe7f5b3

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0c017d2c8dfd86a9534fa7314d2f1f46.exe
Size

294KB
MD5

0c017d2c8dfd86a9534fa7314d2f1f46
SHA1

2c3acea2d0b5b953f58696a776e8bbd11dfcb7f6
SHA256

9be24b5620f91a390cec4c24d6b418366c6cb917f81d4fcb39ac1b7dafe7f5b3
SHA512

3f0c2a9f6cd7ad4eb5c821d297d46946394bb2f900478b56da4214515c24cc37b05cd6e3f859187cebb5146068f52b64b29d4961e2f52ea2180e22670e32b7e7
SSDEEP

6144:Mlxlt7b8pljdSaqYBZamRM8wGoGQW8ErbSDO1Wz/Y/NYVu:2x37b8pGarBl9wtGQYvST8/V

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	0c017d2c8dfd86a9534fa7314d2f1f46.exe

Executes dropped EXE 1 IoCs

pid	Process
1032	3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 1032	4040	0c017d2c8dfd86a9534fa7314d2f1f46.exe	91
PID 4040 wrote to memory of 1032	4040	0c017d2c8dfd86a9534fa7314d2f1f46.exe	91
PID 4040 wrote to memory of 1032	4040	0c017d2c8dfd86a9534fa7314d2f1f46.exe	91

C:\Users\Admin\AppData\Local\Temp\0c017d2c8dfd86a9534fa7314d2f1f46.exe
"C:\Users\Admin\AppData\Local\Temp\0c017d2c8dfd86a9534fa7314d2f1f46.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Users\Admin\AppData\Local\Temp\3.exe
  "C:\Users\Admin\AppData\Local\Temp\3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3.exe

Filesize
126KB

MD5
9d9315a62f2aaaea200614bb88752983

SHA1
d3c8da2602442a8c779434232ad74ecc19314e91

SHA256
a2cb8dec3b29ac58af56952f1a487bcda5135b5e6e5494f27d703142e41356d9

SHA512
593bbc5712a9ca721de7fec20447fd3f81bda6685d34e8ac43f8dd294ac8802aca3fa8cfed1472a10a617c6b81410361dfaa014348caedc250def3b2311c8431

Download Submit
C:\Users\Admin\AppData\Local\Temp\3.exe

Filesize
96KB

MD5
8653f9061171faccf13075e8cc1d791a

SHA1
4e64548f0b99352e43427da1799b772a6af7c797

SHA256
a25a7183226c74ae35b8d88c79736698cdb5411c2bd18677b12f9904e15588aa

SHA512
12a328c06d8757d0eb73f254c55506472ff035529fb2968d8137f9b2dc9baf0875057761285ad5ac583c507e10c751ae361a2e33dae28aac9ae6d339bbe7fb21

Download Submit
memory/1032-25-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/1032-24-0x00000000055A0000-0x00000000055B0000-memory.dmp

Filesize
64KB

Download
memory/1032-21-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/4040-3-0x0000000005480000-0x0000000005A24000-memory.dmp

Filesize
5.6MB

Download
memory/4040-6-0x0000000004CE0000-0x0000000004CEA000-memory.dmp

Filesize
40KB

Download
memory/4040-7-0x0000000004FC0000-0x0000000005016000-memory.dmp

Filesize
344KB

Download
memory/4040-5-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/4040-4-0x0000000004DC0000-0x0000000004E52000-memory.dmp

Filesize
584KB

Download
memory/4040-0-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/4040-23-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/4040-2-0x0000000004D20000-0x0000000004DBC000-memory.dmp

Filesize
624KB

Download
memory/4040-1-0x00000000002D0000-0x00000000002F8000-memory.dmp

Filesize
160KB

Download