60c1e1d653bb867f06c3ecb2ca4b6bfd7f80e17cef75b7d5ac786d51ce8ca227

Analysis

max time kernel
133s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/03/2024, 21:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
60c1e1d653bb867f06c3ecb2ca4b6bfd7f80e17cef75b7d5ac786d51ce8ca227.exe
Size 158KB
Sample240323-zw2dbsfa2s
SHA256 60c1e1d653bb867f06c3ecb2ca4b6bfd7f80e17cef75b7d5ac786d51ce8ca227
MD5 8f0389446bf38ce3992fa3e9bfeae188
SHA1 1ec6f61d0cce078eb21aa7ca05e88dd1bcadfac5
SHA512 a5647554bbfe5d8cbbb5ac9505ad44594e66a2740656eca17ed9c593725a30f36d58dc2ac0038690a76f4afe7951ff174885afc957053654d53d3a3c2cc6766b
SSDEEP 1536:8iVlUPlfHeARjOsOAe2zBN7lE4U1sgzAom8JsuPIclSXsWjcdd6YGJYwYcTG:nVlUPZRxfxE9Vs5cfdd6YGGITG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	60c1e1d653bb867f06c3ecb2ca4b6bfd7f80e17cef75b7d5ac786d51ce8ca227.exe

Executes dropped EXE 1 IoCs

pid	Process
4352	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4352	4076	60c1e1d653bb867f06c3ecb2ca4b6bfd7f80e17cef75b7d5ac786d51ce8ca227.exe	93
PID 4076 wrote to memory of 4352	4076	60c1e1d653bb867f06c3ecb2ca4b6bfd7f80e17cef75b7d5ac786d51ce8ca227.exe	93
PID 4076 wrote to memory of 4352	4076	60c1e1d653bb867f06c3ecb2ca4b6bfd7f80e17cef75b7d5ac786d51ce8ca227.exe	93
PID 4076 wrote to memory of 4880	4076	60c1e1d653bb867f06c3ecb2ca4b6bfd7f80e17cef75b7d5ac786d51ce8ca227.exe	94
PID 4076 wrote to memory of 4880	4076	60c1e1d653bb867f06c3ecb2ca4b6bfd7f80e17cef75b7d5ac786d51ce8ca227.exe	94
PID 4076 wrote to memory of 4880	4076	60c1e1d653bb867f06c3ecb2ca4b6bfd7f80e17cef75b7d5ac786d51ce8ca227.exe	94

C:\Users\Admin\AppData\Local\Temp\60c1e1d653bb867f06c3ecb2ca4b6bfd7f80e17cef75b7d5ac786d51ce8ca227.exe
"C:\Users\Admin\AppData\Local\Temp\60c1e1d653bb867f06c3ecb2ca4b6bfd7f80e17cef75b7d5ac786d51ce8ca227.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 158KB
SHA256 154303b8ee66db4d47cb40547f2fe8bb11a573969d85b75454464d9405d660e2
MD5 d64d5799ceb3eb9a2cdb04191957a125
SHA1 0c893b87291a0daecdfa728d663abcd2270ed753
SHA512 b630e3c29148ce7b0c74e668db27733c8852a9812c459039fa0140d11d21d77a158dd8b0af7cbab54d5dd24139f22eaeeac0ad711010bd40b65bc6d297d2bd6f
SSDEEP 1536:8iVlUPlfHeARjOsOAe2zBN7lE4U1sgzAom8JsuPIclSXsWjcdd6YGJYwYcTn:nVlUPZRxfxE9Vs5cfdd6YGGITn
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 3947c34dfc780b424a3207c6ebe12f667bcb839733107f7a94fe495ec705cb37
MD5 a250860c0687ed9dda488805c025a2d2
SHA1 0c181ed3b46463d35631ca169f0928c33a1da389
SHA512 0286fcd24203ef574c9fc37200e4b0e65d58296162aa89b5424ab48b814bd237e609ab7eaf42a69bdad2ab6414bfbbfaec4757e28b29c69752e0e65a653f665a
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 9fa1c84a28df8620f366aa18bc7131caf4ddc34765f381edb451937e5d9b5823
MD5 358caa8c1af791f1c2d2a7422ec7ac94
SHA1 f7788b8a35b9523529d523b4448d0737c4aa2c09
SHA512 7dd86d8b0bf851b2b133a11e884a4a09827af64701f77abaeb6baa8934f5f48e25f1a2c2072aadfd2f878fa798bd0e03cbb64985ebe9185ba39e8c910bb9d225
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads