37f73b0992d4dd2f029274eb65983708f1036bcde8371444139fbf7a96d18d61

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a8faa51ef8472919564c3097f9594b61.exe
Size

386KB
MD5

a8faa51ef8472919564c3097f9594b61
SHA1

e2c31cc271e96c9ec8ad02e9053d7697cfeb23a5
SHA256

37f73b0992d4dd2f029274eb65983708f1036bcde8371444139fbf7a96d18d61
SHA512

df3dd34e9707c24b14cd898cd0de5b554efee42060eed72ecfbdee33b0fe40f313d8983149a58fde2b70b049a631e453ffa54ddb39f838ae78abd0479561f89a
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzX+:nnOflT/ZFIjBz3xjTxynGUOUhX+

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	a8faa51ef8472919564c3097f9594b61.exe

Executes dropped EXE 1 IoCs

pid	Process
880	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 880	2476	a8faa51ef8472919564c3097f9594b61.exe	92
PID 2476 wrote to memory of 880	2476	a8faa51ef8472919564c3097f9594b61.exe	92
PID 2476 wrote to memory of 880	2476	a8faa51ef8472919564c3097f9594b61.exe	92

C:\Users\Admin\AppData\Local\Temp\a8faa51ef8472919564c3097f9594b61.exe
"C:\Users\Admin\AppData\Local\Temp\a8faa51ef8472919564c3097f9594b61.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
386KB

MD5
520f5dfeeb399e04506657cafaea2cd4

SHA1
09856b44e6de949d908dbea55c135bc1f0a405d7

SHA256
6fedefbd1c2f8cc1bf5526ed31c645d532130f0b48dc5718e732b7c25704582e

SHA512
7d1efecae9366d63cc9c970aef588fc88cb36c4c27284ca68fba70d1f2fb783a824fdf0659babeba3ab0b89697f9a71ffe00c8c78f5a71a2661b6d091bc5aa1d

Download Submit
memory/880-17-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/880-18-0x0000000000530000-0x0000000000536000-memory.dmp

Filesize
24KB

Download
memory/2476-0-0x0000000002260000-0x0000000002266000-memory.dmp

Filesize
24KB

Download
memory/2476-1-0x0000000002260000-0x0000000002266000-memory.dmp

Filesize
24KB

Download
memory/2476-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download