75e08bfba7c98e96009629c6c6dbed46751c9fd591abce4272f7708ce419cbbe

Analysis

max time kernel
162s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f8fb26432587a5b54c479cf5284fd68.exe
Size

15KB
MD5

0f8fb26432587a5b54c479cf5284fd68
SHA1

7417d9926a01bc548d547f2ee312b69a2cb43808
SHA256

75e08bfba7c98e96009629c6c6dbed46751c9fd591abce4272f7708ce419cbbe
SHA512

2d4a1e4d9b105e727c2888c6eb3d97be739bd9d6d579b7ef7d36ccb186be013e7bb29062eb712f4147becb4be247843f102ddb5fe6d0422c2fc08b29b67b9722
SSDEEP

384:0jTuJj+wS7VYcvqbqQ7ARjSovhx8aJZLB6:XiHqf7bovPtr

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	0f8fb26432587a5b54c479cf5284fd68.exe

Executes dropped EXE 1 IoCs

pid	Process
2348	time.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Time Sync = "C:\\Program Files (x86)\\Time Sync\\time.exe"	time.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Time Sync\time.exe	0f8fb26432587a5b54c479cf5284fd68.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2348	1488	0f8fb26432587a5b54c479cf5284fd68.exe	91
PID 1488 wrote to memory of 2348	1488	0f8fb26432587a5b54c479cf5284fd68.exe	91
PID 1488 wrote to memory of 2348	1488	0f8fb26432587a5b54c479cf5284fd68.exe	91

C:\Users\Admin\AppData\Local\Temp\0f8fb26432587a5b54c479cf5284fd68.exe
"C:\Users\Admin\AppData\Local\Temp\0f8fb26432587a5b54c479cf5284fd68.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Program Files (x86)\Time Sync\time.exe
  "C:\Program Files (x86)\Time Sync\time.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Time Sync\time.exe

Filesize
15KB

MD5
0f8fb26432587a5b54c479cf5284fd68

SHA1
7417d9926a01bc548d547f2ee312b69a2cb43808

SHA256
75e08bfba7c98e96009629c6c6dbed46751c9fd591abce4272f7708ce419cbbe

SHA512
2d4a1e4d9b105e727c2888c6eb3d97be739bd9d6d579b7ef7d36ccb186be013e7bb29062eb712f4147becb4be247843f102ddb5fe6d0422c2fc08b29b67b9722

Download Submit
memory/1488-2-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2348-10-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads