16d958728ded74f9ff1bba59c4ca4799620b4558030e7d20a1e0e32cdc826c93

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7719f6e3eb2761112e67f00815e3bf6f.exe
Size

60KB
MD5

7719f6e3eb2761112e67f00815e3bf6f
SHA1

b82b1232bc6fa4792f212123168d5347395db5c8
SHA256

16d958728ded74f9ff1bba59c4ca4799620b4558030e7d20a1e0e32cdc826c93
SHA512

f70dbe2f7d7d3b2978475fba38a126f62484ae2c753f2071ab835923981b99e74bf5dbb915ad435e07f4c516a8fe86e807c974ba6011230b6c5559553f25af20
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMTI09:TCjsIOtEvwDpj5HE/OUHnSMo

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	7719f6e3eb2761112e67f00815e3bf6f.exe

Executes dropped EXE 1 IoCs

pid	Process
4084	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 4084	3000	7719f6e3eb2761112e67f00815e3bf6f.exe	87
PID 3000 wrote to memory of 4084	3000	7719f6e3eb2761112e67f00815e3bf6f.exe	87
PID 3000 wrote to memory of 4084	3000	7719f6e3eb2761112e67f00815e3bf6f.exe	87

C:\Users\Admin\AppData\Local\Temp\7719f6e3eb2761112e67f00815e3bf6f.exe
"C:\Users\Admin\AppData\Local\Temp\7719f6e3eb2761112e67f00815e3bf6f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
61KB

MD5
3dbf034fddcac4de6ba08367d392f14c

SHA1
736199b23a247c1d6e2c6a195c5b32193e1e220c

SHA256
700058cffe41b11f9e14d32f1f72c42d1aa130b8fd8e774b777680ff0ac90246

SHA512
bc14230f11708e1f984161388f4bd960a448af7dba43409811f4ebbeee3daa9ff9734cfc534cb51c797f63c7c9e7ba506ecc1fcb2dbce1f5db121f0117d856cd

Download Submit
memory/3000-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/3000-1-0x0000000000630000-0x0000000000636000-memory.dmp

Filesize
24KB

Download
memory/3000-2-0x0000000000630000-0x0000000000636000-memory.dmp

Filesize
24KB

Download
memory/3000-3-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/3000-17-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/4084-19-0x0000000001F70000-0x0000000001F76000-memory.dmp

Filesize
24KB

Download
memory/4084-21-0x0000000001F50000-0x0000000001F56000-memory.dmp

Filesize
24KB

Download
memory/4084-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download