b9d751235267bec2ee54486e726a847ae3521f4111b9f0ebac9d1e5231e00205

Analysis

max time kernel
144s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

149e726e62cfbbdfb8c0a71b831993fb.exe
Size

11KB
MD5

149e726e62cfbbdfb8c0a71b831993fb
SHA1

2064d3d5f21e03a1ee2175e2474f6a721f843b39
SHA256

b9d751235267bec2ee54486e726a847ae3521f4111b9f0ebac9d1e5231e00205
SHA512

3bec0c4ebcf585681f6172fe6b55a9fdde12860062f5b570ef09483b60ea1edf8fdbfa71e4250eae87057394664e14a26f6fa5247fc110861b7f62a826a03b2e
SSDEEP

192:knIwaOifG69CFFCo/1pMuLdu9w/qnB3xh4oQAwOB+m0i:kS9u6AzCo/1LLwGqxso2OBx

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	149e726e62cfbbdfb8c0a71b831993fb.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5068-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/5068-1-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl\CLSID	149e726e62cfbbdfb8c0a71b831993fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl	149e726e62cfbbdfb8c0a71b831993fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl\CLSID\ = "{6BF52A52-394A-11D3-B153-00C04F79FAA6}"	149e726e62cfbbdfb8c0a71b831993fb.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5068	149e726e62cfbbdfb8c0a71b831993fb.exe
5068	149e726e62cfbbdfb8c0a71b831993fb.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 3600	5068	149e726e62cfbbdfb8c0a71b831993fb.exe	103
PID 5068 wrote to memory of 3600	5068	149e726e62cfbbdfb8c0a71b831993fb.exe	103
PID 5068 wrote to memory of 3600	5068	149e726e62cfbbdfb8c0a71b831993fb.exe	103

C:\Users\Admin\AppData\Local\Temp\149e726e62cfbbdfb8c0a71b831993fb.exe
"C:\Users\Admin\AppData\Local\Temp\149e726e62cfbbdfb8c0a71b831993fb.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wewt0.bat" "
  2⤵
  PID:3600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wewt0.bat

Filesize
274B

MD5
ce07d53a29198f39a1a49ac28e92670c

SHA1
abf51d773b38a7ea9bb58ee272370db2311671f6

SHA256
8f761052ffe47e267c4f038fa602c9eff022a9f0e06257e3fd51323f6723f11d

SHA512
ba48b1c453575f52feb57da3dca0a3fda24026b494d94353ff4477558ab0b8e6d109f57d0883522a85a21a5bb2fb4911fc05170bf986174c8280376602f77719

Download Submit
memory/5068-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5068-1-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download