692266354e686cf064efedb1a2fb80c23324097b5592377714e811312c64d6d6

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 07:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

670f0a36b5ffe74b8b619a5eb734681d.exe
Size

93KB
MD5

670f0a36b5ffe74b8b619a5eb734681d
SHA1

5bdef2776d0fd5a6fd7afa4568c8a063fee5ca6c
SHA256

692266354e686cf064efedb1a2fb80c23324097b5592377714e811312c64d6d6
SHA512

78d8cfc32e166686883e732bf6865d28a3d666f318cf34d5e2e844a042d1ddf640ae89b68240e4c7ca63fafdc05ae5fe018398e497d79a986fb56794a6013c88
SSDEEP

1536:mGyQT05QG70AQz6CwvonnZfr0od8yQoAX2D357dGweFrBNo8DirUrlFIy:mWZD0o3A2lZirztrlFIy

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	670f0a36b5ffe74b8b619a5eb734681d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 4204	5084	670f0a36b5ffe74b8b619a5eb734681d.exe	88
PID 5084 wrote to memory of 4204	5084	670f0a36b5ffe74b8b619a5eb734681d.exe	88
PID 5084 wrote to memory of 4204	5084	670f0a36b5ffe74b8b619a5eb734681d.exe	88

C:\Users\Admin\AppData\Local\Temp\670f0a36b5ffe74b8b619a5eb734681d.exe
"C:\Users\Admin\AppData\Local\Temp\670f0a36b5ffe74b8b619a5eb734681d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Trv..bat" > nul 2> nul
  2⤵
  PID:4204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Trv..bat

Filesize
210B

MD5
3b4645896cf8d7f7eafdfa366fc4b556

SHA1
1e70b362862d6a5fff3bcf47a5723ff90b13abfd

SHA256
948b460c0cca830e1397395a28b6a72f3eea67d7ebdcd250dda1bc2004757805

SHA512
d96bf15fdca9beda711de86810bb449660f666145bb10fc5ebe681ba26aa19152b91e071d54cf6bff9640575ce5fb76a62d924c2df7dd160e5e449c597268556

Download Submit
memory/5084-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5084-1-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/5084-2-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5084-3-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5084-4-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5084-6-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download