4c811d5e811422de16b2dfde6a69154b551ce13ff0773be8fae42b4c8325cd16

Analysis

max time kernel
144s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23c131f6069f020945e7f7b3c6d7482c.exe
Size

94KB
MD5

23c131f6069f020945e7f7b3c6d7482c
SHA1

3a5e3ed7beb5931c16d7ae886e02aad73b836436
SHA256

4c811d5e811422de16b2dfde6a69154b551ce13ff0773be8fae42b4c8325cd16
SHA512

9d27cd3f110a1111310e09322c071044ffccb68051adb5365a445633f79731d3c528595fc81415bc8891d22616b523904ab808a63f0fbb63cf2353bce9631c78
SSDEEP

1536:zfg+M2Y9oH+cpTKeyaI0Z/od8bDbRvU5yYeVYXrgITAGXBB3exYEjpepikFIy:zfgyY9oH+cTKGI0Z/oooeVYXrgI0GXW4

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	23c131f6069f020945e7f7b3c6d7482c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 4692	3888	23c131f6069f020945e7f7b3c6d7482c.exe	88
PID 3888 wrote to memory of 4692	3888	23c131f6069f020945e7f7b3c6d7482c.exe	88
PID 3888 wrote to memory of 4692	3888	23c131f6069f020945e7f7b3c6d7482c.exe	88

C:\Users\Admin\AppData\Local\Temp\23c131f6069f020945e7f7b3c6d7482c.exe
"C:\Users\Admin\AppData\Local\Temp\23c131f6069f020945e7f7b3c6d7482c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Pjj..bat" > nul 2> nul
  2⤵
  PID:4692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Pjj..bat

Filesize
210B

MD5
a958d23c4b9d2feafed766ddd1754351

SHA1
3777bb9ebbc98d3eba861130f0149a08940c59a1

SHA256
f3f65bce9b10ffa84b6690a336c70aa3daab30e07ec74a76106209a10a56655c

SHA512
2d4e0073e246e563098d1d8fafb96e63f0496f51fc91ad51a15627e24450a00abb99c4562fb15b5f6a12fe1ae97ebbaf089648e3e663565e00d2b85aa6aa0d02

Download Submit
memory/3888-1-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/3888-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3888-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3888-4-0x00000000021F0000-0x000000000220B000-memory.dmp

Filesize
108KB

Download
memory/3888-3-0x00000000021F0000-0x000000000220B000-memory.dmp

Filesize
108KB

Download
memory/3888-6-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download