038a1fc6e36f117766abb1957554a7a96da3858812050e0ce2ac894dea87c766

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b301d372b96b89314b207d87438577be.exe
Size

39KB
MD5

b301d372b96b89314b207d87438577be
SHA1

d6c927efbfb21d596cd97a686784df72b5e7b737
SHA256

038a1fc6e36f117766abb1957554a7a96da3858812050e0ce2ac894dea87c766
SHA512

ad55b11724b02a18c9b642567dc9d37549ada023c377f5655cc9de9bd3b5c62bc7a622304620eb997032810f367de14d8c1f57378f288091e8c861f7ba1c142a
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf0w3sp8u5cZnfX2B:bgX4zYcgTEu6QOaryfjqDDw3sCu5mXm

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	b301d372b96b89314b207d87438577be.exe

Executes dropped EXE 1 IoCs

pid	Process
2304	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2304	2780	b301d372b96b89314b207d87438577be.exe	89
PID 2780 wrote to memory of 2304	2780	b301d372b96b89314b207d87438577be.exe	89
PID 2780 wrote to memory of 2304	2780	b301d372b96b89314b207d87438577be.exe	89

C:\Users\Admin\AppData\Local\Temp\b301d372b96b89314b207d87438577be.exe
"C:\Users\Admin\AppData\Local\Temp\b301d372b96b89314b207d87438577be.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
39KB

MD5
ef3d1f12b048065b0e19b3570853de0d

SHA1
ca58e9273439f8796e1f8593f54c84ae226b887b

SHA256
1a1d70b2e53c2f62717b941f7206c9b7b69f89b108e743358ec6b45f99999863

SHA512
7afa1c02ffed525be702c43e308f5224a5fde9746571243e16fd4950c5a58dd9a7f9405102cc26a3c177887b6e62844596f06ff87858130e888199be5d181d64

Download Submit
memory/2304-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/2304-21-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/2780-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/2780-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/2780-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download