7ae4167445cef80f080de5b84c6490a61c1834aa1e05fce43e611c5d054da858

Analysis

max time kernel
119s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 15:38

Target

5f7cdd8c28daba74fd96c1aa9de6d920b026dcea5b596e7e145ffe11c5a4cb8e/5f7cdd8c28daba74fd96c1aa9de6d920b02.exe
Size

5.8MB
MD5

bee46db93df737c15c59a6e1fd132954
SHA1

680c46e55f600933fa0b5658f27f60bc336fcc96
SHA256

5f7cdd8c28daba74fd96c1aa9de6d920b026dcea5b596e7e145ffe11c5a4cb8e
SHA512

69f253a708bbc9adbd4cd909ec1999e9bff0b2423e0b3c59eb760b73f19bdbdd77f0ead4d35afd70bc2925ef3928a76fbac7c5a504f5792e6a661081a1ef9871
SSDEEP

98304:GMe3NP8k6r0Cx2MQkxvJrUTjOaBTbRlNIyJM+DP1zgFcqtZs:+O4FMQk2jVBXRHIL+psfs

Score

7^/10

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

5f7cdd8c28daba74fd96c1aa9de6d920b02.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Control Panel\International\Geo\Nation	5f7cdd8c28daba74fd96c1aa9de6d920b02.exe

C:\Users\Admin\AppData\Local\Temp\5f7cdd8c28daba74fd96c1aa9de6d920b026dcea5b596e7e145ffe11c5a4cb8e\5f7cdd8c28daba74fd96c1aa9de6d920b02.exe
"C:\Users\Admin\AppData\Local\Temp\5f7cdd8c28daba74fd96c1aa9de6d920b026dcea5b596e7e145ffe11c5a4cb8e\5f7cdd8c28daba74fd96c1aa9de6d920b02.exe"
1⤵
- Checks computer location settings
PID:2504

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/2504-0-0x0000000000400000-0x0000000000D82000-memory.dmp

Filesize
9.5MB

Download