0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 09:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe
Size

196KB
MD5

ff8278655cd1407af30c403a7803e644
SHA1

c96d6e51eb8520a76e416e24f3508990e00253d2
SHA256

0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e
SHA512

b4d0dffea25ba62071180c0d5ef9c86de269644485ae85022148792795e8b9b77e6e786cc8995a764ac54c45b14bc454b1729781de0ee5cd53381d269ba54749
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOl:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXg

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe

Executes dropped EXE 1 IoCs

pid	Process
2176	boohost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\boohost.exe	0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe
File opened for modification	C:\Windows\Debug\boohost.exe	0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	boohost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	boohost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4856	0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4904	4856	0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe	34
PID 4856 wrote to memory of 4904	4856	0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe	34
PID 4856 wrote to memory of 4904	4856	0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe	34

C:\Users\Admin\AppData\Local\Temp\0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe
"C:\Users\Admin\AppData\Local\Temp\0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\0D6BBD~1.EXE > nul
  2⤵
  PID:4904

C:\Windows\Debug\boohost.exe
C:\Windows\Debug\boohost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\boohost.exe

Filesize
121KB

MD5
dbad3700b3bee05746fb181ba3b2e866

SHA1
a69f0ae6d42ba485ee03d93ddce859e15b8e989e

SHA256
3ea098a9d6cf209cac564af1427291550b8dd4a7ede1a5917fa30149bd49a0be

SHA512
a2ea667a21221b1a72b09c17f9f3e382330d9bff24c4afbd0af36fb1a3c955039291811bbad2249a60126bc13ce4418c69144196397da1626b2f4627973ae4a2

Download Submit
C:\Windows\debug\boohost.exe

Filesize
191KB

MD5
84b5e353f869e71533c758065452060c

SHA1
421bb6418a832df4ac7690def6abaf64fd0f103d

SHA256
85650c61ca2c0570dd4e9872123578f158edb0e46f6c871df1e5bab61a7ce530

SHA512
b971cea722e4ac8a6ac4ef2560120da70773d0af06e05d8dcda95e82fd3a5fa7c1c71917e97dd96a08d47fee8b7109770e578d7423701c3bd0fd75b42660d117

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads