e02a8dfbd42d9a61b08c94accf043e276ce0c9b2bab5dc88891f1dd972fc539a

Analysis

max time kernel
0s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

23467be4cabbe80e047c68f08521e6c7.exe
Size

219KB
MD5

23467be4cabbe80e047c68f08521e6c7
SHA1

201163552835cae7521d7eeac8dcf7be2ecb6684
SHA256

e02a8dfbd42d9a61b08c94accf043e276ce0c9b2bab5dc88891f1dd972fc539a
SHA512

ea65417e587ab965021dbd27c79ce318556a1508b05123ad5a0cced042599a09f9ee8ea7d702046f385c0ab9898acffa72e4e9806e013407b4a3e16e0e87b32e
SSDEEP

3072:dmBRFLF/a2N+zStuNz5XxCf3/J7zp0h5Djnv1M1TDzsYIvUsh7I3sW:wB/p/rwS+XxCPa1vu1QnvT9Ic

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	23467be4cabbe80e047c68f08521e6c7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
3516	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4068	PING.EXE

C:\Users\Admin\AppData\Local\Temp\23467be4cabbe80e047c68f08521e6c7.exe
"C:\Users\Admin\AppData\Local\Temp\23467be4cabbe80e047c68f08521e6c7.exe"
1⤵
- Checks computer location settings
PID:4884
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 4884 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\23467be4cabbe80e047c68f08521e6c7.exe" & start C:\Users\Admin\AppData\Local\tilhkc.exe -f
  2⤵
  PID:3744
- - C:\Users\Admin\AppData\Local\tilhkc.exe
    C:\Users\Admin\AppData\Local\tilhkc.exe -f
    3⤵
    PID:3756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /pid 4884
1⤵
- Kills process with taskkill
PID:3516

C:\Windows\SysWOW64\PING.EXE
ping -n 3 127.1
1⤵
- Runs ping.exe
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3756-26-0x0000000001000000-0x0000000001137000-memory.dmp

Filesize
1.2MB

Download
memory/3756-21-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/3756-43-0x0000000001000000-0x0000000001137000-memory.dmp

Filesize
1.2MB

Download
memory/3756-35-0x0000000001000000-0x0000000001137000-memory.dmp

Filesize
1.2MB

Download
memory/3756-33-0x0000000001000000-0x0000000001137000-memory.dmp

Filesize
1.2MB

Download
memory/3756-31-0x0000000001000000-0x0000000001137000-memory.dmp

Filesize
1.2MB

Download
memory/3756-10-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/3756-15-0x0000000000490000-0x0000000000492000-memory.dmp

Filesize
8KB

Download
memory/3756-14-0x0000000001000000-0x0000000001137000-memory.dmp

Filesize
1.2MB

Download
memory/3756-12-0x0000000001000000-0x0000000001137000-memory.dmp

Filesize
1.2MB

Download
memory/3756-29-0x0000000001000000-0x0000000001137000-memory.dmp

Filesize
1.2MB

Download
memory/3756-19-0x0000000001000000-0x0000000001137000-memory.dmp

Filesize
1.2MB

Download
memory/3756-17-0x0000000001000000-0x0000000001137000-memory.dmp

Filesize
1.2MB

Download
memory/3756-22-0x0000000001000000-0x0000000001137000-memory.dmp

Filesize
1.2MB

Download
memory/3756-24-0x0000000001000000-0x0000000001137000-memory.dmp

Filesize
1.2MB

Download
memory/4884-1-0x0000000001000000-0x0000000001137000-memory.dmp

Filesize
1.2MB

Download
memory/4884-0-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/4884-6-0x0000000001000000-0x0000000001137000-memory.dmp

Filesize
1.2MB

Download
memory/4884-2-0x0000000001000000-0x0000000001137000-memory.dmp

Filesize
1.2MB

Download
memory/4884-3-0x0000000001000000-0x0000000001137000-memory.dmp

Filesize
1.2MB

Download
memory/4884-4-0x00000000004E0000-0x00000000004E2000-memory.dmp

Filesize
8KB

Download