7d8451e042095684b13ef104a809570fcde9f0af84021bc626e1bb62eb63645d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57522fcb9cd6186cab033b9235f7ada0.exe
Size

102KB
MD5

57522fcb9cd6186cab033b9235f7ada0
SHA1

00bdb72526e36cd626d2cb123cdf2a79df4f1a19
SHA256

7d8451e042095684b13ef104a809570fcde9f0af84021bc626e1bb62eb63645d
SHA512

34721fa3b8c11e7848e8c22c475390a52769a58ac5fda3ca568a3101be82ea1679a2d72baa2580c7fc9a79f1e6f814a58c3e5bfd6c70671f894ac9ed35e78772
SSDEEP

3072:2KNEKBRybJpgGvYHvQ4Se9tziQL/1w13klOMlOmm:tNEKByJVT4xtzBLi13kl3l

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	57522fcb9cd6186cab033b9235f7ada0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 628	2840	57522fcb9cd6186cab033b9235f7ada0.exe	93
PID 2840 wrote to memory of 628	2840	57522fcb9cd6186cab033b9235f7ada0.exe	93
PID 2840 wrote to memory of 628	2840	57522fcb9cd6186cab033b9235f7ada0.exe	93

C:\Users\Admin\AppData\Local\Temp\57522fcb9cd6186cab033b9235f7ada0.exe
"C:\Users\Admin\AppData\Local\Temp\57522fcb9cd6186cab033b9235f7ada0.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Pkj..bat" > nul 2> nul
  2⤵
  PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Pkj..bat

Filesize
210B

MD5
5f31ca2b4766f3a8239e34e6447c2698

SHA1
5055bddf7b578ffc368642c25c5a57cb47f0c0a2

SHA256
44aaafdd93dba9b761bb97510d7b5be1987f458d1dd30e7061207ed71d2df3d3

SHA512
22b7806c482ab830607a2f91998427a24229afa807c2c98d9e72bed633f9fdddf0b23f383b22dfb14ae6cede64c6bc170e8774dbe8b3ce5e7d584f32bc792e29

Download Submit
memory/2840-0-0x00000000009C0000-0x00000000009D5000-memory.dmp

Filesize
84KB

Download
memory/2840-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2840-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2840-4-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download