ff4f4f0a670081c13f645eadc6a33eef4ba1124eefb3047e57bc4693e3e61f26

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a769878668842308bf602f6392c44ce.exe
Size

37KB
MD5

4a769878668842308bf602f6392c44ce
SHA1

3fbd3aa76a36454e1c0621df49f974c23c54ed38
SHA256

ff4f4f0a670081c13f645eadc6a33eef4ba1124eefb3047e57bc4693e3e61f26
SHA512

965aad613f3033942cade8db60a885012c57db27dddc99db0499a7c491d2447031ea4677485b7b8800e80deeb5ee17f1a1dc2c4aaafd8d244bc757d34bcdcc80
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLenB8vfH:ZzFbxmLPWQMOtEvwDpjLeSfH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation	4a769878668842308bf602f6392c44ce.exe

Executes dropped EXE 1 IoCs

pid	Process
4624	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 4624	4028	4a769878668842308bf602f6392c44ce.exe	86
PID 4028 wrote to memory of 4624	4028	4a769878668842308bf602f6392c44ce.exe	86
PID 4028 wrote to memory of 4624	4028	4a769878668842308bf602f6392c44ce.exe	86

C:\Users\Admin\AppData\Local\Temp\4a769878668842308bf602f6392c44ce.exe
"C:\Users\Admin\AppData\Local\Temp\4a769878668842308bf602f6392c44ce.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
38KB

MD5
282cf095d22e9e1fdfd50a1cfefc2b05

SHA1
dbffee1ee899f58db4ca5b908b80577daa84b7a9

SHA256
ed27358478b0e1a784db7ae257c92b5edcf9db06e52e0dcf21f605f6e0d18886

SHA512
a3cbd175a66bf5cc15407cbe428f7142cb5f6c63a7b8abdaee91428fba63cbe42bd952952a135855c0660cef97ac33de51733b2da2534d5a187842686a21554a

Download Submit
memory/4028-0-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/4028-1-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/4028-2-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/4028-3-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/4028-17-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/4624-19-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download
memory/4624-22-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download