75fc888b151f57ebbb30e128e52b06f792b7a8764d35a131520086477fd3440d

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47a2b02bb9f10c849a85ab506c405fd5.exe
Size

34KB
MD5

47a2b02bb9f10c849a85ab506c405fd5
SHA1

2b041d55a6e925b8c99b6bc6e46ed8173af6fa87
SHA256

75fc888b151f57ebbb30e128e52b06f792b7a8764d35a131520086477fd3440d
SHA512

db2c60dc1f92e4afab29cea5e8e27b4fff9c3630e646c09bb5247fd9ffe91bcf332bab577bf881a4be34b397ed7b75447ca2841de01a2b7148813e91657a4a1b
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunexRlSrxVfdsHY2l:bA74zYcgT/Ekd0ryfjPIunYw161

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	47a2b02bb9f10c849a85ab506c405fd5.exe

Executes dropped EXE 1 IoCs

pid	Process
1596	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 1596	4924	47a2b02bb9f10c849a85ab506c405fd5.exe	85
PID 4924 wrote to memory of 1596	4924	47a2b02bb9f10c849a85ab506c405fd5.exe	85
PID 4924 wrote to memory of 1596	4924	47a2b02bb9f10c849a85ab506c405fd5.exe	85

C:\Users\Admin\AppData\Local\Temp\47a2b02bb9f10c849a85ab506c405fd5.exe
"C:\Users\Admin\AppData\Local\Temp\47a2b02bb9f10c849a85ab506c405fd5.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
34KB

MD5
08ebed0e2e119ed2d46ccf9b92ca9673

SHA1
9c052f5dfd70904c58d08e02907a47ab486783aa

SHA256
61a35fe0563e6cc1bc31531892a00864dcdd7b12c5158b37cea467e768438454

SHA512
94691080fe78323ba29a12465f432694c74d55ce347d1fae8862b357f784d8522feb0d5a8790170c4784f21779fad04f2aba3e6b421947aff9a520fb7179952b

Download Submit
memory/1596-18-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/1596-17-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/4924-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4924-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4924-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download