6f8dc90c6f96abc862ebe7198fc4c83fe1125eedb1dd8078e5c3728311b9990b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f8dc90c6f96abc862ebe7198fc4c83fe1125eedb1dd8078e5c3728311b9990b.exe
Size

37KB
MD5

a79ba1536ae0f6b3df27e1162d2bfcb4
SHA1

6c3f9ccb09458c03e555d44e8d3315fbe7055157
SHA256

6f8dc90c6f96abc862ebe7198fc4c83fe1125eedb1dd8078e5c3728311b9990b
SHA512

eb0cdbcac32bc94f213667a5fe695077ce270e8775f4d87bb683471d9e1bac07daa7fdd071e65387d309b62c537b3344cc8c22b1fd3f09f88ab5e3da1837e536
SSDEEP

768:U5ZFhzgxucryOmJQqO3VhDWiNlW+O96QhlqNU9jlF9jvH:U57mucrFmJQqO3VhDWiC+i6QnjPBvH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	6f8dc90c6f96abc862ebe7198fc4c83fe1125eedb1dd8078e5c3728311b9990b.exe

Executes dropped EXE 1 IoCs

pid	Process
3888	hhcbrnaff.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 3888	3680	6f8dc90c6f96abc862ebe7198fc4c83fe1125eedb1dd8078e5c3728311b9990b.exe	83
PID 3680 wrote to memory of 3888	3680	6f8dc90c6f96abc862ebe7198fc4c83fe1125eedb1dd8078e5c3728311b9990b.exe	83
PID 3680 wrote to memory of 3888	3680	6f8dc90c6f96abc862ebe7198fc4c83fe1125eedb1dd8078e5c3728311b9990b.exe	83

C:\Users\Admin\AppData\Local\Temp\6f8dc90c6f96abc862ebe7198fc4c83fe1125eedb1dd8078e5c3728311b9990b.exe
"C:\Users\Admin\AppData\Local\Temp\6f8dc90c6f96abc862ebe7198fc4c83fe1125eedb1dd8078e5c3728311b9990b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe
  "C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe"
  2⤵
  - Executes dropped EXE
  PID:3888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe

Filesize
37KB

MD5
653a1e6f48ff942fd118a709b09d62df

SHA1
f361854e8a9b989ee083b8d74a05740c793269b9

SHA256
a73d346a8258b7ac1ca3e2ec6f58d3512c0bc5e82e7bb42f60bea422ed324541

SHA512
a9e689f63c8b69dd28508a599f5ff64c934218eb4006529ba5e452b87622f1b17318c75b6c52a6b7b01a5eb60159c2d4322681617962e01f1a9482520dd8668d

Download Submit
memory/3680-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3680-2-0x00007FFBC1170000-0x00007FFBC1365000-memory.dmp

Filesize
2.0MB

Download
memory/3680-11-0x00007FFBC1170000-0x00007FFBC1365000-memory.dmp

Filesize
2.0MB

Download
memory/3680-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3888-12-0x00007FFBC1170000-0x00007FFBC1365000-memory.dmp

Filesize
2.0MB

Download
memory/3888-13-0x00007FFBC1170000-0x00007FFBC1365000-memory.dmp

Filesize
2.0MB

Download