0b1ba550b6365d2f2a5dc7cbcaf4624c9d028e13d2ddd5bc69b3481b103d0789

Analysis

max time kernel
1s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1613468c1ec5d4771a928d8957aa50d2.exe
Size

1.4MB
MD5

1613468c1ec5d4771a928d8957aa50d2
SHA1

e61d9b7f229307c6f578d86817721a5f01952cc9
SHA256

0b1ba550b6365d2f2a5dc7cbcaf4624c9d028e13d2ddd5bc69b3481b103d0789
SHA512

02c4e8ab5f3f4e14857b33dbf3ae78151f726b679199be94c2fef9f2b1349acebbed2dd830ddccb0b037dbf32eea72275b0d574eb691f5451512f6f772efbf29
SSDEEP

24576:I8JWFWNaOvknjVHX1OE5DmvDtM29TY2mFHPc5DMRD1z4SnRbcGI8Ogc:b6WcbnjxTSv5rYVvmg4SnF8D

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	1613468c1ec5d4771a928d8957aa50d2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4496	schtasks.exe
2396	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\1613468c1ec5d4771a928d8957aa50d2.exe
"C:\Users\Admin\AppData\Local\Temp\1613468c1ec5d4771a928d8957aa50d2.exe"
1⤵
- Checks computer location settings
PID:4976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\Admin\AppData\Local\Temp\services32.exe"' & exit
  2⤵
  PID:3252
- C:\Users\Admin\AppData\Local\Temp\services32.exe
  "C:\Users\Admin\AppData\Local\Temp\services32.exe"
  2⤵
  PID:2284
- - C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
    3⤵
    PID:8
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\Admin\AppData\Local\Temp\services32.exe"' & exit
    3⤵
    PID:3796

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\Admin\AppData\Local\Temp\services32.exe"'
1⤵
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\Admin\AppData\Local\Temp\services32.exe"'
1⤵
- Creates scheduled task(s)
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-43-0x0000000000EF0000-0x0000000000EF6000-memory.dmp

Filesize
24KB

Download
memory/8-53-0x00007FFEC18C0000-0x00007FFEC2381000-memory.dmp

Filesize
10.8MB

Download
memory/8-54-0x000000001CBA0000-0x000000001CBB0000-memory.dmp

Filesize
64KB

Download
memory/8-44-0x00007FFEC18C0000-0x00007FFEC2381000-memory.dmp

Filesize
10.8MB

Download
memory/8-45-0x000000001CBA0000-0x000000001CBB0000-memory.dmp

Filesize
64KB

Download
memory/2284-21-0x00007FF730F40000-0x00007FF731534000-memory.dmp

Filesize
6.0MB

Download
memory/2284-29-0x0000000003780000-0x0000000003790000-memory.dmp

Filesize
64KB

Download
memory/2284-52-0x00007FF730F40000-0x00007FF731534000-memory.dmp

Filesize
6.0MB

Download
memory/2284-51-0x00007FFEC18C0000-0x00007FFEC2381000-memory.dmp

Filesize
10.8MB

Download
memory/2284-25-0x00007FFEDF340000-0x00007FFEDF350000-memory.dmp

Filesize
64KB

Download
memory/2284-47-0x00007FF730F40000-0x00007FF731534000-memory.dmp

Filesize
6.0MB

Download
memory/2284-26-0x00007FF730F40000-0x00007FF731534000-memory.dmp

Filesize
6.0MB

Download
memory/2284-28-0x00007FF730F40000-0x00007FF731534000-memory.dmp

Filesize
6.0MB

Download
memory/2284-27-0x00007FFEC18C0000-0x00007FFEC2381000-memory.dmp

Filesize
10.8MB

Download
memory/4976-0-0x00007FF751270000-0x00007FF751864000-memory.dmp

Filesize
6.0MB

Download
memory/4976-3-0x00007FF751270000-0x00007FF751864000-memory.dmp

Filesize
6.0MB

Download
memory/4976-5-0x00007FFEC18C0000-0x00007FFEC2381000-memory.dmp

Filesize
10.8MB

Download
memory/4976-7-0x0000000003DA0000-0x0000000003DB2000-memory.dmp

Filesize
72KB

Download
memory/4976-6-0x0000000002FF0000-0x0000000002FFA000-memory.dmp

Filesize
40KB

Download
memory/4976-23-0x00007FFEC18C0000-0x00007FFEC2381000-memory.dmp

Filesize
10.8MB

Download
memory/4976-22-0x00007FF751270000-0x00007FF751864000-memory.dmp

Filesize
6.0MB

Download
memory/4976-4-0x00007FF751270000-0x00007FF751864000-memory.dmp

Filesize
6.0MB

Download
memory/4976-2-0x00007FFEDF340000-0x00007FFEDF350000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads