4050baf2578dc721f2b0b3db352f6ad7f7e350fb56ec83e9abbdada78375312b

Analysis

max time kernel
144s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2024 17:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4050baf2578dc721f2b0b3db352f6ad7f7e350fb56ec83e9abbdada78375312b.exe
Size

195KB
MD5

34eb33d86050b7036d30b083ef68cde0
SHA1

c478549d1d16a4113784d30807c5672bc3a26fae
SHA256

4050baf2578dc721f2b0b3db352f6ad7f7e350fb56ec83e9abbdada78375312b
SHA512

2fcd50c759e88498c85f372b92374b568a87df58d1afb2aca12606c108c0c99896c484b74288d7e891492b8f151632cf21b4c83378557488090d1580b7bb496d
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOc:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXX1

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	4050baf2578dc721f2b0b3db352f6ad7f7e350fb56ec83e9abbdada78375312b.exe

Executes dropped EXE 1 IoCs

pid	Process
2580	hauhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\hauhost.exe	4050baf2578dc721f2b0b3db352f6ad7f7e350fb56ec83e9abbdada78375312b.exe
File opened for modification	C:\Windows\Debug\hauhost.exe	4050baf2578dc721f2b0b3db352f6ad7f7e350fb56ec83e9abbdada78375312b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	hauhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	hauhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1864	4050baf2578dc721f2b0b3db352f6ad7f7e350fb56ec83e9abbdada78375312b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2560	1864	4050baf2578dc721f2b0b3db352f6ad7f7e350fb56ec83e9abbdada78375312b.exe	97
PID 1864 wrote to memory of 2560	1864	4050baf2578dc721f2b0b3db352f6ad7f7e350fb56ec83e9abbdada78375312b.exe	97
PID 1864 wrote to memory of 2560	1864	4050baf2578dc721f2b0b3db352f6ad7f7e350fb56ec83e9abbdada78375312b.exe	97

C:\Users\Admin\AppData\Local\Temp\4050baf2578dc721f2b0b3db352f6ad7f7e350fb56ec83e9abbdada78375312b.exe
"C:\Users\Admin\AppData\Local\Temp\4050baf2578dc721f2b0b3db352f6ad7f7e350fb56ec83e9abbdada78375312b.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4050BA~1.EXE > nul
  2⤵
  PID:2560

C:\Windows\Debug\hauhost.exe
C:\Windows\Debug\hauhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\hauhost.exe

Filesize
195KB

MD5
172ab7a76736ef6aa2f6381437df0882

SHA1
24dac788579a63c0a023d255eb77d680e17fc7a1

SHA256
b56ad63c1844a21976d8a111485bb113d0304781e15e603ffd30dbb8a0b79014

SHA512
17992f76aa59d5fe00a0243ba838074221b947a1c6799c7019272df7e04dc0ebe7b1f18cbd7e2145e9b56dc009e676acfe9fe27deb9794811298e3c10c6aa4e8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads