8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83

Analysis

max time kernel
169s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83.exe
Size

49KB
MD5

3092a5e779e7c58ff738de2b72304dc6
SHA1

03899234509ba9e59f4ce149e0b2c43f996780e8
SHA256

8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83
SHA512

5a8786fba323499ef9efa008688c53577b52dc3693a256e5f21efdd4fcb65fbd5258b4fe1a88d768454462f58c28500635c451218f6c89c037992322b3e43b6f
SSDEEP

1536:PwP9999999996FoYkytbdH4zd7JoISHm3y:P4UDN

Score

9^/10

Malware Config

Signatures

Detects executables built or packed with MPress PE compressor 4 IoCs

resource	yara_rule
behavioral2/memory/348-0-0x0000000000400000-0x000000000040C000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/348-1-0x0000000000400000-0x000000000040C000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0007000000023214-6.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4528-10-0x0000000000400000-0x000000000040C000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83.exe

Executes dropped EXE 1 IoCs

pid	Process
4528	lsemc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 4528	348	8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83.exe	92
PID 348 wrote to memory of 4528	348	8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83.exe	92
PID 348 wrote to memory of 4528	348	8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83.exe	92

C:\Users\Admin\AppData\Local\Temp\8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83.exe
"C:\Users\Admin\AppData\Local\Temp\8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:348
- C:\Users\Admin\AppData\Local\Temp\lsemc.exe
  "C:\Users\Admin\AppData\Local\Temp\lsemc.exe"
  2⤵
  - Executes dropped EXE
  PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lsemc.exe

Filesize
50KB

MD5
82fde595d87d376494bc120753de81f4

SHA1
c623556c1661f24de357838f9abcef30919588e7

SHA256
2a851f6fa0e7b7c1be6c0cad184d387c233205dc602e0f6e30f26c9917b61810

SHA512
b9ce9ea1aa688f2f4e5f2112b78eb50326ae15a9038eeae2b85db05dc528bd53a3eac783ad5d0f5332bab4bb87126613b5e5f94804ce63c3e6b018d54ae13ec1

Download Submit
memory/348-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/348-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4528-10-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download