7538f4dee883ecceb35c145241b83f621a8de7b120c8dc5af5df156470c44c08

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88504463894754bc911b2758e08a410c.exe
Size

80KB
MD5

88504463894754bc911b2758e08a410c
SHA1

f519dbeb5ee2c57dc49131036df998a2d085dd04
SHA256

7538f4dee883ecceb35c145241b83f621a8de7b120c8dc5af5df156470c44c08
SHA512

957cc07ab32df3fa0f3c32b4d209827a81817cba2c4be1d29f08c6922809e8ca80cfd6bd6aa8a82cc203c7b8531d1aca85d14128080113af52700a875dbb40bc
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMre:TCjsIOtEvwDpj5HE/OUHnSMY

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	88504463894754bc911b2758e08a410c.exe

Executes dropped EXE 1 IoCs

pid	Process
1620	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1620	1608	88504463894754bc911b2758e08a410c.exe	86
PID 1608 wrote to memory of 1620	1608	88504463894754bc911b2758e08a410c.exe	86
PID 1608 wrote to memory of 1620	1608	88504463894754bc911b2758e08a410c.exe	86

C:\Users\Admin\AppData\Local\Temp\88504463894754bc911b2758e08a410c.exe
"C:\Users\Admin\AppData\Local\Temp\88504463894754bc911b2758e08a410c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
80KB

MD5
6d13884b8d3209bd496dbc4cc93564be

SHA1
4577682b980db47e877dfa9e20a59b2b546ea240

SHA256
3816e253c0cdf3ea53d0a6997c14c5267952a2d93a9392b93a9e15c2dcfc5225

SHA512
e683a267d8376b83fe62d313f341b5f9bb32b62184efd9bdf63c989f6f3592154dfac8a74a61a42a8ff46599b6b044e86ade26803ea4152309ecea60c342ced9

Download Submit
memory/1608-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1608-1-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/1608-2-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/1608-3-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/1608-25-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1620-18-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1620-19-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/1620-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download