f99c3cb1c8b1bbfd61dc86244936605bc777a2c2d2aa15d64e069ac04a393c3d

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 08:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

530ce49455b4b11dd3e963fbb2e2c2fb.exe
Size

109KB
MD5

530ce49455b4b11dd3e963fbb2e2c2fb
SHA1

2a51788f7b6d8871dadc0870a1adb24c93acb3a3
SHA256

f99c3cb1c8b1bbfd61dc86244936605bc777a2c2d2aa15d64e069ac04a393c3d
SHA512

8ac3945c51b4c146d33b9a3dcea28059641837694b40737cd3ec782e5baecf975395afae35456626e7339ce9db24433b83f03378d363063def142b1f76b72483
SSDEEP

3072:SD3Hl5JVSa4GhR+lbTlVd3c6h2o1DNo9:y3Xok+llLQoO

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	530ce49455b4b11dd3e963fbb2e2c2fb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 5088	4688	530ce49455b4b11dd3e963fbb2e2c2fb.exe	92
PID 4688 wrote to memory of 5088	4688	530ce49455b4b11dd3e963fbb2e2c2fb.exe	92
PID 4688 wrote to memory of 5088	4688	530ce49455b4b11dd3e963fbb2e2c2fb.exe	92

C:\Users\Admin\AppData\Local\Temp\530ce49455b4b11dd3e963fbb2e2c2fb.exe
"C:\Users\Admin\AppData\Local\Temp\530ce49455b4b11dd3e963fbb2e2c2fb.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Gwf..bat" > nul 2> nul
  2⤵
  PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Gwf..bat

Filesize
210B

MD5
bfe57ee738dd0a049a43fde541d7a89b

SHA1
a6254369b346f1e1b7688c5ae4ce0f07737a45ad

SHA256
287291b2e3f75b30e9350d715e59b68716ad26d07f3ce6425ff470d1370c24ee

SHA512
933ab2e4c1156ca4766a100797ab3426383b2af6f57858a29b2f9d79ba31ddaf29b2669d201fcdd2b1aef5159f595ccd761cedbfe4c12c86c2eb9748b8fc22b0

Download Submit
memory/4688-0-0x0000000001FB0000-0x0000000001FBE000-memory.dmp

Filesize
56KB

Download
memory/4688-1-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4688-3-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4688-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download