38d3eed64bb20d1b66dca4a298adca6370d2d2ee82e59985532f9009798b6274

Analysis

max time kernel
126s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e02f640286a6f1f21b3ec13bf4d89235.exe
Size

147KB
MD5

e02f640286a6f1f21b3ec13bf4d89235
SHA1

8c5004af690737f9b536325fbf9285669d8941b4
SHA256

38d3eed64bb20d1b66dca4a298adca6370d2d2ee82e59985532f9009798b6274
SHA512

98be7c455d92c513771e030e7e5e9d94a71cd591b7260334aae04b83a6cdc6dc77678f3ab03a77be7510d0a05b0cad3a83ef67a0358a54199d586bb95919635d
SSDEEP

3072:5xqtou73+ZfYBMGdSuwbpah+5BJlgZfYoE:DG+ZwBMWKpx5BJaZwf

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	e02f640286a6f1f21b3ec13bf4d89235.exe

Executes dropped EXE 2 IoCs

pid	Process
444	server.exe
2308	v11f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3376	444	WerFault.exe	88
5072	444	WerFault.exe	88

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 444	2656	e02f640286a6f1f21b3ec13bf4d89235.exe	88
PID 2656 wrote to memory of 444	2656	e02f640286a6f1f21b3ec13bf4d89235.exe	88
PID 2656 wrote to memory of 444	2656	e02f640286a6f1f21b3ec13bf4d89235.exe	88
PID 2656 wrote to memory of 2308	2656	e02f640286a6f1f21b3ec13bf4d89235.exe	90
PID 2656 wrote to memory of 2308	2656	e02f640286a6f1f21b3ec13bf4d89235.exe	90
PID 2656 wrote to memory of 2308	2656	e02f640286a6f1f21b3ec13bf4d89235.exe	90

C:\Users\Admin\AppData\Local\Temp\e02f640286a6f1f21b3ec13bf4d89235.exe
"C:\Users\Admin\AppData\Local\Temp\e02f640286a6f1f21b3ec13bf4d89235.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Executes dropped EXE
  PID:444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 252
    3⤵
    - Program crash
    PID:3376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 304
    3⤵
    - Program crash
    PID:5072
- C:\Users\Admin\AppData\Local\Temp\v11f.exe
  "C:\Users\Admin\AppData\Local\Temp\v11f.exe"
  2⤵
  - Executes dropped EXE
  PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 444 -ip 444
1⤵
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 444 -ip 444
1⤵
PID:4024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
69KB

MD5
3f3603e52b0e61fd35b625fba6130229

SHA1
d12ebb80f130dd5453385c05ddce25b3b60dec9b

SHA256
427e417a115fa88447fd1f71b40ed112bdb6ea45efb86125f7e5fe3dd5f23552

SHA512
9d99306dacb431116ba7a87db916d2df0bad13d38dfa070d09a75fa20f4321f7aefe159c8a9c394272b0a9184548d0a423ccade2aeb313f163ee11195a5f6ec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\v11f.exe

Filesize
38KB

MD5
c3b81c5f84e67fbf2dbd264711db8e9d

SHA1
a22c823948b4e6b8863de5c50eaba6b267c56817

SHA256
ff1e7a19253ac58988bfca4b75a1afa330bc2970de6eacb7161277919f675c20

SHA512
d38a15d1e878f622d19112f5388c5b6c237638590704062f31ebc7659f7253d5f6c6d5d218a371b097384cef10d845e36b8d3061ade78f6a0f3e700bcf1d6b1d

Download Submit
memory/444-11-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/444-17-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download