76859c4aa070f788aaf1d9a363c29e5187e2d60130a7efa6e65bc3f722f03825

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0f1ad98cdf72dd5fc94d08b032e57b1.exe
Size

211KB
MD5

a0f1ad98cdf72dd5fc94d08b032e57b1
SHA1

7e61795691e555fe9cf53bc6f045c939f9053589
SHA256

76859c4aa070f788aaf1d9a363c29e5187e2d60130a7efa6e65bc3f722f03825
SHA512

4bbe2648c7f6ad885be5a7e867c63da66410575919fb13c6da1669ae7bf33b59512cc3a85689533967249116b765267ea8ac2c1933599f4839b10fa3467fcd19
SSDEEP

3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/e8A7pjBFy11AC:o68i3odBiTl2+TCU/ixhuhuIb

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart"	a0f1ad98cdf72dd5fc94d08b032e57b1.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winhash_up.exez	a0f1ad98cdf72dd5fc94d08b032e57b1.exe
File created	C:\Windows\winhash_up.exe	a0f1ad98cdf72dd5fc94d08b032e57b1.exe
File created	C:\Windows\SHARE_TEMP\Icon5.ico	a0f1ad98cdf72dd5fc94d08b032e57b1.exe
File created	C:\Windows\SHARE_TEMP\Icon6.ico	a0f1ad98cdf72dd5fc94d08b032e57b1.exe
File created	C:\Windows\SHARE_TEMP\Icon7.ico	a0f1ad98cdf72dd5fc94d08b032e57b1.exe
File created	C:\Windows\winhash_up.exez	a0f1ad98cdf72dd5fc94d08b032e57b1.exe
File created	C:\Windows\SHARE_TEMP\Icon3.ico	a0f1ad98cdf72dd5fc94d08b032e57b1.exe
File created	C:\Windows\SHARE_TEMP\Icon10.ico	a0f1ad98cdf72dd5fc94d08b032e57b1.exe
File created	C:\Windows\SHARE_TEMP\Icon12.ico	a0f1ad98cdf72dd5fc94d08b032e57b1.exe
File created	C:\Windows\SHARE_TEMP\Icon14.ico	a0f1ad98cdf72dd5fc94d08b032e57b1.exe
File created	C:\Windows\bugMAKER.bat	a0f1ad98cdf72dd5fc94d08b032e57b1.exe
File created	C:\Windows\SHARE_TEMP\Icon2.ico	a0f1ad98cdf72dd5fc94d08b032e57b1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 3220	4052	a0f1ad98cdf72dd5fc94d08b032e57b1.exe	87
PID 4052 wrote to memory of 3220	4052	a0f1ad98cdf72dd5fc94d08b032e57b1.exe	87
PID 4052 wrote to memory of 3220	4052	a0f1ad98cdf72dd5fc94d08b032e57b1.exe	87

C:\Users\Admin\AppData\Local\Temp\a0f1ad98cdf72dd5fc94d08b032e57b1.exe
"C:\Users\Admin\AppData\Local\Temp\a0f1ad98cdf72dd5fc94d08b032e57b1.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat
  2⤵
  - Checks computer location settings
  PID:3220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\bugMAKER.bat

Filesize
76B

MD5
eba30ccf4eb45c87b0e0ff51fe7c599e

SHA1
d1e861ae77959032e292a57aa659f98651ed6e5e

SHA256
db50060ce7b3a04cf68c87469f79d7e2f1658d4d6323717da2f1de3f6e6f3e87

SHA512
464eaa3852d5820c02cee39915b2aa513aedb43ab012b665986c333ccb6d84af73ebdf00d2fe32e7a535b3436c11277fc7109594d10c2d678e5c6b352c08db22

Download Submit
memory/4052-24-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads