869be95e2c6000e8754347ed159a06208b9a202afa5ef90ad2838564d548195f

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 00:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

869be95e2c6000e8754347ed159a06208b9a202afa5ef90ad2838564d548195f.exe
Size

39KB
MD5

95cac826638fbb525f0e5065d4c62421
SHA1

d95c87857eb9dfea56ee30a261e8176c8e6ab68b
SHA256

869be95e2c6000e8754347ed159a06208b9a202afa5ef90ad2838564d548195f
SHA512

28aafb6ffb81d151bbfcdeaaf97bf71402994d95881f6812feae321253eb9b063b2083162525465f60e5f6e67ddb90dcdc430b3c8770ee0f6853ec5aa5fd811a
SSDEEP

768:/8sJAnZCQBwuUuequfinJxnUeGRVkcQ4b:/8sMnlequfa/FGTvQ4b

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	869be95e2c6000e8754347ed159a06208b9a202afa5ef90ad2838564d548195f.exe

Executes dropped EXE 1 IoCs

pid	Process
4396	justupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 4396	4276	869be95e2c6000e8754347ed159a06208b9a202afa5ef90ad2838564d548195f.exe	86
PID 4276 wrote to memory of 4396	4276	869be95e2c6000e8754347ed159a06208b9a202afa5ef90ad2838564d548195f.exe	86
PID 4276 wrote to memory of 4396	4276	869be95e2c6000e8754347ed159a06208b9a202afa5ef90ad2838564d548195f.exe	86

C:\Users\Admin\AppData\Local\Temp\869be95e2c6000e8754347ed159a06208b9a202afa5ef90ad2838564d548195f.exe
"C:\Users\Admin\AppData\Local\Temp\869be95e2c6000e8754347ed159a06208b9a202afa5ef90ad2838564d548195f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Users\Admin\AppData\Local\Temp\justupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\justupdater.exe"
  2⤵
  - Executes dropped EXE
  PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\justupdater.exe

Filesize
39KB

MD5
49a1242c918da2b0f860f15e8909f959

SHA1
8c8e1971fdfd06227d19a1d69d2fc33b392e65d2

SHA256
5c8b3cd928597e039d5d858b6bdc76c64e918cac8e95ae152aa5fbd22c297bf7

SHA512
3e36bfa94eddf9ae20a0fd8b53783a22a5ea84213dfe8a9c1582489c8a82f998c7e084e62eae58a9209037cf4f39fd7ebba9d1bf21a436e9ec8f5981936646e0

Download Submit
memory/4276-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4396-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download