c041beed85d7bfbdaf12772017598ca9e33b2ee784a5b1913dafc42282b830b1

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7accc60c133697433d0f0d9df559312.exe
Size

38KB
MD5

d7accc60c133697433d0f0d9df559312
SHA1

3ea826328850d8f1cd6ef07509ba60364a3c6370
SHA256

c041beed85d7bfbdaf12772017598ca9e33b2ee784a5b1913dafc42282b830b1
SHA512

5cba904767433bf27ee9e9c44bd77e7188d2cf274d59e177923bf125e70a40faca352c916dbfa5ed9d9dd1250775fd3f49cde9fd56a468d46228610a141eca3a
SSDEEP

768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnv/Snx:m5nkFNMOtEvwDpjG8hy

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	d7accc60c133697433d0f0d9df559312.exe

Executes dropped EXE 1 IoCs

pid	Process
2684	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 2684	4716	d7accc60c133697433d0f0d9df559312.exe	95
PID 4716 wrote to memory of 2684	4716	d7accc60c133697433d0f0d9df559312.exe	95
PID 4716 wrote to memory of 2684	4716	d7accc60c133697433d0f0d9df559312.exe	95

C:\Users\Admin\AppData\Local\Temp\d7accc60c133697433d0f0d9df559312.exe
"C:\Users\Admin\AppData\Local\Temp\d7accc60c133697433d0f0d9df559312.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2432,i,12161922670941700748,3348345705955601576,262144 --variations-seed-version /prefetch:8
1⤵
PID:4152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
38KB

MD5
fe69cdaa3141888ef309230f44041dac

SHA1
446295ee9c615887b5e6c606fa8304a577ca8c9e

SHA256
154677cc5ada0c3551c2ea67885107fc28ae02a324499c46b69e2ce3537456a3

SHA512
98404d79cc2f7f59aa3de182474015a61750136c738d3c981f78b3d5e7247707ba2feb96f4e58d866f8198a9e2fa0f8ce6f2b4484a288f0736fcca2558aa9d7c

Download Submit
memory/2684-19-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/2684-21-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/2684-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/4716-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/4716-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4716-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4716-3-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4716-17-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download