9d30c658ca18193448e07745911143aec39f88d0cfa64c57b38c84a5433d55ef

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3dc20e46cc3a830466a4f3816589d787.exe
Size

210KB
MD5

3dc20e46cc3a830466a4f3816589d787
SHA1

3b28cf05fb338afcab3e1f0799065f6b2468a6d6
SHA256

9d30c658ca18193448e07745911143aec39f88d0cfa64c57b38c84a5433d55ef
SHA512

b5f02a89ab6d42eb30d3fb6978ce68ec28e1c9640f9bc4e7c9604a68db8019a0105a8d021af0e2f9b40838f6c0808c467995c17a72622c3b65424a600d607b6d
SSDEEP

1536:cSuwW46/lo1z54YBwhI9UxL4yzxEt3a5LKEXmkwEeCVbRrsc4AdKUMbR:cSK431z54T69mL48Exas8hwEecqdR

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	3dc20e46cc3a830466a4f3816589d787.exe

Executes dropped EXE 1 IoCs

pid	Process
4404	Switch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3964	3dc20e46cc3a830466a4f3816589d787.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 4404	3964	3dc20e46cc3a830466a4f3816589d787.exe	92
PID 3964 wrote to memory of 4404	3964	3dc20e46cc3a830466a4f3816589d787.exe	92

C:\Users\Admin\AppData\Local\Temp\3dc20e46cc3a830466a4f3816589d787.exe
"C:\Users\Admin\AppData\Local\Temp\3dc20e46cc3a830466a4f3816589d787.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Users\Admin\AppData\Local\Temp\Switch.exe
  "C:\Users\Admin\AppData\Local\Temp\Switch.exe"
  2⤵
  - Executes dropped EXE
  PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Switch.exe

Filesize
27KB

MD5
641afa4800f0c28b7bc7e63d72b19fbd

SHA1
19e72739491c778b2dfe3db73f80d4b244eb445a

SHA256
58c2c58fcba1f958da9b0a29dc3073b1240c1432ec784b7421382bec675d6ab1

SHA512
56e6cc30ac298afd02a2e22fb0ac2be8a2800405f7632eba18f5ff2103e315b0815de7763e9e247229ad142be8d0e62b3e8084e5686a6563790c4f0f649e96ef

Download Submit
memory/3964-22-0x0000000005A70000-0x0000000005A80000-memory.dmp

Filesize
64KB

Download
memory/3964-1-0x0000000075010000-0x00000000757C0000-memory.dmp

Filesize
7.7MB

Download
memory/3964-2-0x0000000005D90000-0x0000000006334000-memory.dmp

Filesize
5.6MB

Download
memory/3964-3-0x00000000057E0000-0x0000000005872000-memory.dmp

Filesize
584KB

Download
memory/3964-4-0x0000000005A70000-0x0000000005A80000-memory.dmp

Filesize
64KB

Download
memory/3964-5-0x00000000058A0000-0x00000000058AA000-memory.dmp

Filesize
40KB

Download
memory/3964-6-0x0000000005A70000-0x0000000005A80000-memory.dmp

Filesize
64KB

Download
memory/3964-18-0x0000000075010000-0x00000000757C0000-memory.dmp

Filesize
7.7MB

Download
memory/3964-28-0x0000000005A70000-0x0000000005A80000-memory.dmp

Filesize
64KB

Download
memory/3964-0-0x0000000000DC0000-0x0000000000DFA000-memory.dmp

Filesize
232KB

Download
memory/4404-20-0x00007FFE4EE80000-0x00007FFE4F821000-memory.dmp

Filesize
9.6MB

Download
memory/4404-21-0x00000000019B0000-0x00000000019C0000-memory.dmp

Filesize
64KB

Download
memory/4404-23-0x000000001C610000-0x000000001CADE000-memory.dmp

Filesize
4.8MB

Download
memory/4404-24-0x00007FFE4EE80000-0x00007FFE4F821000-memory.dmp

Filesize
9.6MB

Download
memory/4404-25-0x000000001CAE0000-0x000000001CB7C000-memory.dmp

Filesize
624KB

Download
memory/4404-26-0x0000000001760000-0x0000000001768000-memory.dmp

Filesize
32KB

Download
memory/4404-27-0x000000001CC80000-0x000000001CCCC000-memory.dmp

Filesize
304KB

Download
memory/4404-19-0x000000001BFA0000-0x000000001C046000-memory.dmp

Filesize
664KB

Download
memory/4404-29-0x00007FFE4EE80000-0x00007FFE4F821000-memory.dmp

Filesize
9.6MB

Download
memory/4404-30-0x00000000019B0000-0x00000000019C0000-memory.dmp

Filesize
64KB

Download
memory/4404-31-0x00000000019B0000-0x00000000019C0000-memory.dmp

Filesize
64KB

Download