77f853548d034089a74dd09109997701581ce73754035dedb9a74aa8cb67c059

Analysis

max time kernel
93s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4654c8c982168dac7967ce401f2f100.exe
Size

88KB
MD5

a4654c8c982168dac7967ce401f2f100
SHA1

c9e0028f54d35ca9ce011acf8f1ce405dc6f0b55
SHA256

77f853548d034089a74dd09109997701581ce73754035dedb9a74aa8cb67c059
SHA512

73389de57b9e181ce58152dd42ba5d7aeb7324918f8ffe9ad0efd152215d700b5c581cead66b6619b5504e2b3eeaa41a6c48d3ddec2a90acc87438c9f4b29a29
SSDEEP

1536:AoQIKo6iHk1t7qaeJdb3rydGs+af7f6QEiRvbl9lr:ANIKUytWaKb33glblv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	a4654c8c982168dac7967ce401f2f100.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/396-3-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral2/memory/396-8-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 676	396	a4654c8c982168dac7967ce401f2f100.exe	89
PID 396 wrote to memory of 676	396	a4654c8c982168dac7967ce401f2f100.exe	89
PID 396 wrote to memory of 676	396	a4654c8c982168dac7967ce401f2f100.exe	89

C:\Users\Admin\AppData\Local\Temp\a4654c8c982168dac7967ce401f2f100.exe
"C:\Users\Admin\AppData\Local\Temp\a4654c8c982168dac7967ce401f2f100.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  PID:676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a..bat

Filesize
210B

MD5
3a80f2add3559d4be9eea769bf481c8b

SHA1
0a535b9d394afe7ac47da0a74556543e30347273

SHA256
535e03fb083c6f9b14ac26a13bef1a8cb8402ed4b2117b46d03d52d9dc34ae93

SHA512
0df2b73a19168f5b56504b90d43ace5febb47e9a27f11bac267a052b57ef235678fbb61b31e0be2465acef766f9f54497ee7344d1284bf855a9ced21a16e79cb

Download Submit
memory/396-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/396-2-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/396-1-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/396-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/396-4-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/396-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download