95dd8934771ad27944b8ac57ad036c02c445005454dedfd61c4437089a29027a

Analysis

max time kernel
194s
max time network
231s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-01-2024 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95dd8934771ad27944b8ac57ad036c02c445005454dedfd61c4437089a29027a.exe
Size

16.4MB
MD5

3c6a3d45da15c9cb5d5d7a86d25efbed
SHA1

24f723cab4ec50d8f546fcf3a340070a3f81a27a
SHA256

95dd8934771ad27944b8ac57ad036c02c445005454dedfd61c4437089a29027a
SHA512

8b5ede22dcbec58736b835ebce8854d012441f3dea0d0815e91091a5c4ca657d7a4d256bc91df8b925a2a370839b5fd97c8b5fdf7cb74bbf34405e06ef1c2491
SSDEEP

49152:8f4iXn3IPNBwr8b49LB0fflDpCUWffuxuFUSO9N8TUllCRYhMZ8qgWkHU6wsUKkb:8AG

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	95dd8934771ad27944b8ac57ad036c02c445005454dedfd61c4437089a29027a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
4084	timeout.exe
2596	timeout.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1840	1008	95dd8934771ad27944b8ac57ad036c02c445005454dedfd61c4437089a29027a.exe	93
PID 1008 wrote to memory of 1840	1008	95dd8934771ad27944b8ac57ad036c02c445005454dedfd61c4437089a29027a.exe	93
PID 1008 wrote to memory of 1840	1008	95dd8934771ad27944b8ac57ad036c02c445005454dedfd61c4437089a29027a.exe	93
PID 1840 wrote to memory of 2596	1840	cmd.exe	94
PID 1840 wrote to memory of 2596	1840	cmd.exe	94
PID 1840 wrote to memory of 2596	1840	cmd.exe	94
PID 1840 wrote to memory of 4084	1840	cmd.exe	95
PID 1840 wrote to memory of 4084	1840	cmd.exe	95
PID 1840 wrote to memory of 4084	1840	cmd.exe	95
PID 1840 wrote to memory of 4076	1840	cmd.exe	98
PID 1840 wrote to memory of 4076	1840	cmd.exe	98
PID 1840 wrote to memory of 4076	1840	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\95dd8934771ad27944b8ac57ad036c02c445005454dedfd61c4437089a29027a.exe
"C:\Users\Admin\AppData\Local\Temp\95dd8934771ad27944b8ac57ad036c02c445005454dedfd61c4437089a29027a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5EA2.tmp.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2596
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4084
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\\PolyGraph, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
    3⤵
    PID:4076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5EA2.tmp.bat

Filesize
298B

MD5
506fe909a6cc30472038e5ef3afe9253

SHA1
50f40b7e16eac1cc19ed51ee7b4eef928089201c

SHA256
8056b57379e8ee62797f55847ab8cef591582d70b9ec93f80af1c4a42f01ed2c

SHA512
88ae587500edac79721ca15ce78d444312b0db062c245aa31900bac7b1576a4060edcb46c6ec422d9102448805527d8415fd2df2ed55a0f1113a353681814f67

Download Submit
memory/1008-0-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/1008-1-0x0000000000E10000-0x0000000001E86000-memory.dmp

Filesize
16.5MB

Download
memory/1008-4-0x00000000099B0000-0x00000000099C0000-memory.dmp

Filesize
64KB

Download
memory/1008-11-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download