945b15d82646489b6b6f3c7190456028266712627f2b10e50d4923735017601b

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

945b15d82646489b6b6f3c7190456028266712627f2b10e50d4923735017601b.exe
Size

29KB
MD5

7fa1fa986ba15f78524ad2790851b3f4
SHA1

d532c347d00d93e8e0606559bfb1bf096fc4b0bb
SHA256

945b15d82646489b6b6f3c7190456028266712627f2b10e50d4923735017601b
SHA512

34928129f1e339de5064a4850b96e81c5fa98e87d08bea7e1ade28a30f5435d47c5da84ba6438a6a1ab74c724bea53ad62f602c1bae12639e71b2017c847b0ec
SSDEEP

384:iQ4n4X4f0y4vEhbTKFMWWeJqljfgj3WfgVl6DuwcPM2fTcz:ong40YfnWWeJqhIKuUDmG

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	945b15d82646489b6b6f3c7190456028266712627f2b10e50d4923735017601b.exe

Executes dropped EXE 1 IoCs

pid	Process
2680	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 2680	4404	945b15d82646489b6b6f3c7190456028266712627f2b10e50d4923735017601b.exe	85
PID 4404 wrote to memory of 2680	4404	945b15d82646489b6b6f3c7190456028266712627f2b10e50d4923735017601b.exe	85
PID 4404 wrote to memory of 2680	4404	945b15d82646489b6b6f3c7190456028266712627f2b10e50d4923735017601b.exe	85

C:\Users\Admin\AppData\Local\Temp\945b15d82646489b6b6f3c7190456028266712627f2b10e50d4923735017601b.exe
"C:\Users\Admin\AppData\Local\Temp\945b15d82646489b6b6f3c7190456028266712627f2b10e50d4923735017601b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
30KB

MD5
15bbb0732513387fe11778b0a4cb004b

SHA1
4bef4db369c104888a567b97b7763c5fd9bd6cdf

SHA256
ed7d1f54a9ed56eafb8a6d0a1d26032353bec18ac86ec1ab1b99e9ed1d36666c

SHA512
ee3a20e2b4fccbbbc1cd609b820e3c04b9488ab77b6770476a9bbf1e4d0bed01575b1a84d80a58ace6d3e374481cade94d8c3ff60db49f25b732959a0b7f46a0

Download Submit