2091a3ee7243b75faa94f333de578cffdd8cfac6b0fece5d68907782815e7efa

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9afaa472c69db5a3cc4cab8b98c4da06.exe
Size 117KB
Sample240214-g4fgqabc71
SHA256 2091a3ee7243b75faa94f333de578cffdd8cfac6b0fece5d68907782815e7efa
MD5 9afaa472c69db5a3cc4cab8b98c4da06
SHA1 8ac3ce9d231a2132d20092edac8795ebc6215e52
SHA512 cf531eca413be0cb699306b4560388f8681e71683cbefc0365aac45e9ef86201c6080d7ff328c65726007a271045973e741094d622f9cb27f30cc893103c6114
SSDEEP 3072:cl3iJHgxVXbTziCg0uqsG6PUtkuqo4fiIZA+n2rC:U3BVXY0uoKdaiZ2O
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	9afaa472c69db5a3cc4cab8b98c4da06.exe

Executes dropped EXE 1 IoCs

pid	Process
3140	tt.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\tt.exe	9afaa472c69db5a3cc4cab8b98c4da06.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3616	3140	WerFault.exe	84

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1164	9afaa472c69db5a3cc4cab8b98c4da06.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 3140	1164	9afaa472c69db5a3cc4cab8b98c4da06.exe	84
PID 1164 wrote to memory of 3140	1164	9afaa472c69db5a3cc4cab8b98c4da06.exe	84
PID 1164 wrote to memory of 3140	1164	9afaa472c69db5a3cc4cab8b98c4da06.exe	84

C:\Users\Admin\AppData\Local\Temp\9afaa472c69db5a3cc4cab8b98c4da06.exe
"C:\Users\Admin\AppData\Local\Temp\9afaa472c69db5a3cc4cab8b98c4da06.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\tt.exe
  "C:\Windows\tt.exe"
  2⤵
  - Executes dropped EXE
  PID:3140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 220
    3⤵
    - Program crash
    PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3140 -ip 3140
1⤵
PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tt.exe

Path C:\Windows\tt.exe
Size 106KB
SHA256 af4934d03fff9c536d9761d9c672920abb27eb573e8b7917280fac1d012d1a98
MD5 9e337f2e06f1a83e5c10ba90cf72b057
SHA1 af517039c03588f3542318dead9605f238059f29
SHA512 7d33cb7fcaf608de974e5849d5de6a63e9cc39084efd81889c2ad8502147cb689d8df15236b01528eed5efcc95d1f5da743164c95f5c7b4bc14bc5120b316866
SSDEEP 3072:MW+BM5kftDIOyskQlb1e3Xz0bZI9PFy3rSKJV:MRmZgowClcdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1164-0-0x0000000000400000-0x000000000041F200-memory.dmp

Download

memory/3140-9-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3140-10-0x0000000000400000-0x0000000000435000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads