97263275f39c7cefd0585291ddda9224adcea7196063bb0cee37d735ee1145bb

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

140ff27b5127418c51d1a0d7826f90ef.exe
Size

612KB
MD5

140ff27b5127418c51d1a0d7826f90ef
SHA1

02af91ad9be82a68e7cc525f93e9d87b09ab8f52
SHA256

97263275f39c7cefd0585291ddda9224adcea7196063bb0cee37d735ee1145bb
SHA512

80b29ba7edd403e9b48c7c1e3b0e392fb4b21f6694a1679de55a99ba55fff7585156afd637e6f05208ec39ba9d97c03ac7a7c0470e1c1af64506d12701c4b6b1
SSDEEP

12288:ZU49Y2k4Dwm9vQQ3yJf/slAzc3YoEvHgSMZ5V+p8TDoaay:ZUiYyZlQ2ytslAw3yvZg5VxTT

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	140ff27b5127418c51d1a0d7826f90ef.exe

Executes dropped EXE 1 IoCs

pid	Process
3616	myFile.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 3616	4088	140ff27b5127418c51d1a0d7826f90ef.exe	94
PID 4088 wrote to memory of 3616	4088	140ff27b5127418c51d1a0d7826f90ef.exe	94

C:\Users\Admin\AppData\Local\Temp\140ff27b5127418c51d1a0d7826f90ef.exe
"C:\Users\Admin\AppData\Local\Temp\140ff27b5127418c51d1a0d7826f90ef.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Users\Admin\AppData\Local\Temp\myFile.exe
  "C:\Users\Admin\AppData\Local\Temp\myFile.exe"
  2⤵
  - Executes dropped EXE
  PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\myFile.exe

Filesize
93KB

MD5
046e4eb89c8554c0139ad2f90d669e11

SHA1
71dcdd6933c4124df23e87fda286a8ea04283864

SHA256
38284d34d1d2cac8716861ebb969eb2f4a9b89f9c5aafa92a4bd4649e9e0dde5

SHA512
8a93ddab6453e9cfea62f3e0de87c248fc8d3e87a685f59e57dd7e66b30b45bba577d801756cd20be04a306773747b781ad9fa137b3e00a37f4b925858638d67

Download Submit
C:\Users\Admin\AppData\Local\Temp\myFile.exe

Filesize
339KB

MD5
808502752ca0492aca995e9b620d507b

SHA1
668c40bb6c792b3502b4eefd0916febc8dbd5182

SHA256
0f56c703e9b7ddeb90646927bac05a5c6d95308c8e13b88e5d4f4b572423e036

SHA512
9a35ea626bb411531efe905a4a81c3dfdebf86b222d3005e846c87f9501b3d91a6164ef44c2ca72070fe8c33f2bfbfb58b4f96353be1aa8c2c6f9390827a5afa

Download Submit
memory/4088-1-0x00000000743C0000-0x0000000074B70000-memory.dmp

Filesize
7.7MB

Download
memory/4088-0-0x0000000000C60000-0x0000000000C68000-memory.dmp

Filesize
32KB

Download
memory/4088-2-0x00000000057F0000-0x0000000005800000-memory.dmp

Filesize
64KB

Download
memory/4088-11-0x00000000743C0000-0x0000000074B70000-memory.dmp

Filesize
7.7MB

Download