40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/02/2024, 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe
Size

196KB
MD5

d9d4084af9aee0904c32bc85d0d0d599
SHA1

44cb44e5373603e2d7d48875d04522ae725e2d8c
SHA256

40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2
SHA512

8c627011f242d72ad65b77bde8dfe5053494b68f1a9406bd3ce973d87c5a499479409185ae9fa632a7b03eeba30d003bc228c6d3e3badcf7d59ec37eedd1a75f
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCO6:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe

Executes dropped EXE 1 IoCs

pid	Process
1136	nkmhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\nkmhost.exe	40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe
File opened for modification	C:\Windows\Debug\nkmhost.exe	40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4556	40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 4276	4556	40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe	87
PID 4556 wrote to memory of 4276	4556	40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe	87
PID 4556 wrote to memory of 4276	4556	40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe	87

C:\Users\Admin\AppData\Local\Temp\40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe
"C:\Users\Admin\AppData\Local\Temp\40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\40D740~1.EXE > nul
  2⤵
  PID:4276

C:\Windows\Debug\nkmhost.exe
C:\Windows\Debug\nkmhost.exe
1⤵
- Executes dropped EXE
PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\nkmhost.exe

Filesize
196KB

MD5
9f8cbf3e03d6cdab6430eb30b277b0bf

SHA1
e91bde81c6a22c1f6367f1de88549617b540a13f

SHA256
304a3919be61b00d9c34297f0a567e077aaa1128054166e93074e51758a1bd82

SHA512
d3bf1c24856e7736d14fd913021b184f9295c19a9dd4c24da635a0aa97c462cdb8991a6bda65a07324a47950110d2f38ea1dc91cbed258f7706a0202cd8b95b5

Download Submit