f4fe38f1dde79b4346d154d6c849d909adc7b8b9d90d7f15051f15de7992d85d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4fe38f1dde79b4346d154d6c849d909adc7b8b9d90d7f15051f15de7992d85d.exe
Size

56KB
MD5

366b0b111f9c1e054e3a559e563d10aa
SHA1

c3538490abcd431ebf6f8450201d28d43b5ee668
SHA256

f4fe38f1dde79b4346d154d6c849d909adc7b8b9d90d7f15051f15de7992d85d
SHA512

308134b03ea1f4cb7eca1dc9e8d231ff64a9ae8e0afe58c292abe427d5e6f1dbf2409d9958e817fa13257a5faafea002013678e8126048bcf5c1ad91a5844683
SSDEEP

768:75wRI7PsED3VK2+ZtyOjgO4r9vFAg2rqrINT0qxn0GVkpkY/6Kf2OGx:+wYTjipvF2N0qxdkpkwZXGx

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	f4fe38f1dde79b4346d154d6c849d909adc7b8b9d90d7f15051f15de7992d85d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	hcbnaf.exe

Executes dropped EXE 1 IoCs

pid	Process
3144	hcbnaf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 3144	1612	f4fe38f1dde79b4346d154d6c849d909adc7b8b9d90d7f15051f15de7992d85d.exe	82
PID 1612 wrote to memory of 3144	1612	f4fe38f1dde79b4346d154d6c849d909adc7b8b9d90d7f15051f15de7992d85d.exe	82
PID 1612 wrote to memory of 3144	1612	f4fe38f1dde79b4346d154d6c849d909adc7b8b9d90d7f15051f15de7992d85d.exe	82

C:\Users\Admin\AppData\Local\Temp\f4fe38f1dde79b4346d154d6c849d909adc7b8b9d90d7f15051f15de7992d85d.exe
"C:\Users\Admin\AppData\Local\Temp\f4fe38f1dde79b4346d154d6c849d909adc7b8b9d90d7f15051f15de7992d85d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe
  "C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe

Filesize
56KB

MD5
da9f0d59018c70035803ed9e2bb38808

SHA1
86fc67a19d5ae46b490ccb3022331004296e689f

SHA256
e0270ebb234ac1b00dc415ecf771bae4c35841c85b068b2b6a992f0c975d33f4

SHA512
a97e36e8c4cbcf7fd6fb58473c67173ce2601caa0c2e514b3636a45fed21173a719222a793edb02baab3e79357c7758121d548c9fefb118c8bf250b09de2fad0

Download Submit