8feac925008ab1d2cef9258c93687131223d65c129e94d75356890e6450f9ae6

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d739f388e6c419f7a9921e7ebed2806.exe
Size

108KB
MD5

4d739f388e6c419f7a9921e7ebed2806
SHA1

790d22ec116bef03768e6e3a80ccb4ad0a8e199e
SHA256

8feac925008ab1d2cef9258c93687131223d65c129e94d75356890e6450f9ae6
SHA512

fa3e46451508995b2baa67b8da68a91d7b0904f156c8601214055970175edf582978b275330659e930a4b4c8f2d0db2aab2d5413d410dbf678ad388c4217f0b6
SSDEEP

3072:X/oGZiJ11Yn3VVbMq+cfg3eNssucg7J6vD:X/osODYn3VVbMCggEYvD

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	4d739f388e6c419f7a9921e7ebed2806.exe

Executes dropped EXE 1 IoCs

pid	Process
3280	uctdate.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\Fonts\1.ho	4d739f388e6c419f7a9921e7ebed2806.exe
File opened for modification	C:\WINDOWS\Fonts\uctdate.exe	4d739f388e6c419f7a9921e7ebed2806.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4400	4d739f388e6c419f7a9921e7ebed2806.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3280	uctdate.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 2632	4400	4d739f388e6c419f7a9921e7ebed2806.exe	89
PID 4400 wrote to memory of 2632	4400	4d739f388e6c419f7a9921e7ebed2806.exe	89
PID 4400 wrote to memory of 2632	4400	4d739f388e6c419f7a9921e7ebed2806.exe	89
PID 2632 wrote to memory of 4044	2632	cmd.exe	92
PID 2632 wrote to memory of 4044	2632	cmd.exe	92
PID 2632 wrote to memory of 4044	2632	cmd.exe	92
PID 4044 wrote to memory of 2332	4044	net.exe	93
PID 4044 wrote to memory of 2332	4044	net.exe	93
PID 4044 wrote to memory of 2332	4044	net.exe	93
PID 4400 wrote to memory of 3280	4400	4d739f388e6c419f7a9921e7ebed2806.exe	101
PID 4400 wrote to memory of 3280	4400	4d739f388e6c419f7a9921e7ebed2806.exe	101
PID 4400 wrote to memory of 3280	4400	4d739f388e6c419f7a9921e7ebed2806.exe	101

C:\Users\Admin\AppData\Local\Temp\4d739f388e6c419f7a9921e7ebed2806.exe
"C:\Users\Admin\AppData\Local\Temp\4d739f388e6c419f7a9921e7ebed2806.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net stop sharedaccess
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      PID:2332
- C:\WINDOWS\Fonts\uctdate.exe
  "C:\WINDOWS\Fonts\uctdate.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Fonts\uctdate.exe

Filesize
44KB

MD5
8abde00f602025b7d5b4147571cbbe7f

SHA1
910fa81ee799cd59c3d8b7c2e98a7150e75a1272

SHA256
990dbdc3bdef9007e876cb492d0c3673ea8aa13e7c64d553bc1d47a942a35b8f

SHA512
17f014218b4a8d988c36c5f3c57f9adb082e4eb80f81f1e793d168898d5891cb41012fe6fbf81a5f811f0b72ffc289c295334225bfe4a168ac5a933ab0e60c44

Download Submit
memory/4400-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4400-12-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download