0c58f5fcb2b2386a753bed089f63979fe7e922626efc2eb6e1b32aceb5504046

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c58f5fcb2b2386a753bed089f63979fe7e922626efc2eb6e1b32aceb5504046.exe
Size

197KB
MD5

4383704b18dd83c24f9a149050d8c7fa
SHA1

a783147f89cd14a4a57d6653b30bbcd3b0f7e65a
SHA256

0c58f5fcb2b2386a753bed089f63979fe7e922626efc2eb6e1b32aceb5504046
SHA512

e0e548e439a5a7862b9604d4037c2f8681b827c0b509c4098e84ec146a09c45f446ced2dea11d2713bdd1d917708cac11e77d66bfae2eaac46544a37f532abd8
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOE:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXR

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation	0c58f5fcb2b2386a753bed089f63979fe7e922626efc2eb6e1b32aceb5504046.exe

Executes dropped EXE 1 IoCs

pid	Process
4952	ksqhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\ksqhost.exe	0c58f5fcb2b2386a753bed089f63979fe7e922626efc2eb6e1b32aceb5504046.exe
File opened for modification	C:\Windows\Debug\ksqhost.exe	0c58f5fcb2b2386a753bed089f63979fe7e922626efc2eb6e1b32aceb5504046.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3448	0c58f5fcb2b2386a753bed089f63979fe7e922626efc2eb6e1b32aceb5504046.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 232	3448	0c58f5fcb2b2386a753bed089f63979fe7e922626efc2eb6e1b32aceb5504046.exe	90
PID 3448 wrote to memory of 232	3448	0c58f5fcb2b2386a753bed089f63979fe7e922626efc2eb6e1b32aceb5504046.exe	90
PID 3448 wrote to memory of 232	3448	0c58f5fcb2b2386a753bed089f63979fe7e922626efc2eb6e1b32aceb5504046.exe	90

C:\Users\Admin\AppData\Local\Temp\0c58f5fcb2b2386a753bed089f63979fe7e922626efc2eb6e1b32aceb5504046.exe
"C:\Users\Admin\AppData\Local\Temp\0c58f5fcb2b2386a753bed089f63979fe7e922626efc2eb6e1b32aceb5504046.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\0C58F5~1.EXE > nul
  2⤵
  PID:232

C:\Windows\Debug\ksqhost.exe
C:\Windows\Debug\ksqhost.exe
1⤵
- Executes dropped EXE
PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\ksqhost.exe

Filesize
197KB

MD5
b96e1e865417bb1aaa256d0098338f77

SHA1
9fa324744133d49988803f0ab8b9dd92b8b6c4ae

SHA256
0163a2cd51e6d73fe09960bf74bd62039c07a1291e13babce4c27469252006a4

SHA512
d707013282274159c1f01d3f22c20c544dab28082e7335fee7f196a2a61978b0b753b1f23d2d257bb7ded0e3bd22a0bfa9d92849831cb3b52b94a9f8628503b1

Download Submit