55f8e1f14e74637969080aeff441fc320ffbb29411351331fb76fc009ffc7ce3

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96bff2573c5778118eb13dde0e187b20.exe
Size

60KB
MD5

96bff2573c5778118eb13dde0e187b20
SHA1

9360acdfc6ab6420682f39c64b2f96e59fe0df57
SHA256

55f8e1f14e74637969080aeff441fc320ffbb29411351331fb76fc009ffc7ce3
SHA512

0db591ce84c8a38d6ce178d527863e1237744354444e468d9c867f2e17c0863ee8af18c63cbbb26e3878702d1140bfe017364a5c0803be429b5f76ef91523b13
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj38lD/cMAT+lBOM:ZVxkGOtEvwDpj4

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	96bff2573c5778118eb13dde0e187b20.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
3672	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 3672	3232	96bff2573c5778118eb13dde0e187b20.exe	99
PID 3232 wrote to memory of 3672	3232	96bff2573c5778118eb13dde0e187b20.exe	99
PID 3232 wrote to memory of 3672	3232	96bff2573c5778118eb13dde0e187b20.exe	99

C:\Users\Admin\AppData\Local\Temp\96bff2573c5778118eb13dde0e187b20.exe
"C:\Users\Admin\AppData\Local\Temp\96bff2573c5778118eb13dde0e187b20.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
60KB

MD5
5adb609d22b3c992a032bb85ef4b526b

SHA1
19b5f5e83a4492490b73a70316eae787b24ba4f4

SHA256
c9048ffe7ff35cde9940e7ba85661dbc1dc2e1bedabbacfe7c63c3fface887ec

SHA512
4c70e70781cbe124d86ceb2724304e12a9a406e89c14495620218567f7a3f2abaa9f48051fc56858691846bec9f91b746bc08657f71949761445e42b39fa0e4e

Download Submit
memory/3232-0-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/3232-1-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/3232-2-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/3232-3-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/3232-23-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/3672-17-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/3672-20-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/3672-19-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download