Analysis

  • max time kernel
    147s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 13:09

General

  • Target

    19804bebc5eca1512755c7324bb75f8e.exe

  • Size

    42KB

  • MD5

    19804bebc5eca1512755c7324bb75f8e

  • SHA1

    e2bae8771fad08811ae951ab7147eaf032302cfb

  • SHA256

    4fedcb68d2ebe01a6d8cb78f1aaf82df01612f1ec3c0c6586d2078fbf2ae0e9f

  • SHA512

    27142c4bae878deaf4cb3870a8c1cd439315b3588fc35d575dfddb2d8ef5eed36f880278be9081a959755b66aa5ff6105226d585c9d685c6c6147b97331741fb

  • SSDEEP

    768:EgylgZ+NX8W51hYE4tyuGjCNi+zD/EzCkC5HVYPCF:EgyWZw8WdxjCNDpHyP

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\19804bebc5eca1512755c7324bb75f8e.exe
    "C:\Users\Admin\AppData\Local\Temp\19804bebc5eca1512755c7324bb75f8e.exe"
    1⤵
    • Checks computer location settings
    PID:1452

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1452-0-0x0000000000560000-0x000000000056E000-memory.dmp

    Filesize

    56KB

  • memory/1452-1-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/1452-2-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/1452-43-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/1452-46-0x0000000000560000-0x000000000056E000-memory.dmp

    Filesize

    56KB