becdca1973d77c8b17588b1b39f766484162f30f363829cc51fb446051a58a3a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.BScope.TrojanRansom.Agent.30669.9261.exe
Size

3.9MB
MD5

a599acc94ed2c20d13164dedeb8bd680
SHA1

7af3e5b238c16937f0d6a6892758664fdd9e6334
SHA256

becdca1973d77c8b17588b1b39f766484162f30f363829cc51fb446051a58a3a
SHA512

cec32da69e3fa99b407320dd6439c8733bf6643a492b0512cfe4dcf9891ab66b1e6ef8a7a608720cc26be039b2fbdc9bb20cd7a266e34a59a6b5b393b0825a3e
SSDEEP

98304:J88zY0jiVGMTTv6urhF0waWorDiTC8mCx/oWczK:JZs3GMv9njc3aEK

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SecuriteInfo.com.BScope.TrojanRansom.Agent.30669.9261.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.BScope.TrojanRansom.Agent.30669.9261.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

SecuriteInfo.com.BScope.TrojanRansom.Agent.30669.9261.exe

pid process

1428 SecuriteInfo.com.BScope.TrojanRansom.Agent.30669.9261.exe

pid	process
1428	SecuriteInfo.com.BScope.TrojanRansom.Agent.30669.9261.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.TrojanRansom.Agent.30669.9261.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.TrojanRansom.Agent.30669.9261.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dxa1048.tmp\dxa1049.tmp

Filesize
199KB

MD5
97d18167ecfac75067078ca1fbfc45df

SHA1
36029be9cae2224a7ae2c55ab9206088a22f57ea

SHA256
acfbb3755cd2b212d4bced3d36467f0cb7233ad9a079d217e82f486b977cf055

SHA512
12019cb073811b1638caf2ae74343aa29990b7d194f2b338eaba94232f28597b23e959dbb62571b1bbcf069f97842cbbdab8cd0200ed9c6cc90ad599be88d221

Download Submit
memory/1428-10-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1428-11-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download