65f1a46722b855d51dfcd7e941af7ec4740a62489a35077c92d9379073207f09

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65f1a46722b855d51dfcd7e941af7ec4740a62489a35077c92d9379073207f09.exe
Size

37KB
MD5

0108c5e038a470fc03603ec5de223fc0
SHA1

69467d03d960505975b9d3ce3281dac633d85b8f
SHA256

65f1a46722b855d51dfcd7e941af7ec4740a62489a35077c92d9379073207f09
SHA512

d2406d9c4acc4e99ac1d0d4247af5c9544b9908eff8d14324fee8caeedd22c1bc7ef337a43c027f2d4f6718f4f659f7853114f2404871b45eae04086f5a481dd
SSDEEP

384:zOnwR2tHMnHFAmhyq0MrP66MUeUmrTLWdq4:zQwRySHhyq0MrfMjzWdq4

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

65f1a46722b855d51dfcd7e941af7ec4740a62489a35077c92d9379073207f09.exehcbnaf.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	65f1a46722b855d51dfcd7e941af7ec4740a62489a35077c92d9379073207f09.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	hcbnaf.exe

Executes dropped EXE 1 IoCs

Processes:

hcbnaf.exe

pid process

4160 hcbnaf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4160	hcbnaf.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

65f1a46722b855d51dfcd7e941af7ec4740a62489a35077c92d9379073207f09.exe

description	pid	process	target process
PID 1944 wrote to memory of 4160	1944	65f1a46722b855d51dfcd7e941af7ec4740a62489a35077c92d9379073207f09.exe	hcbnaf.exe
PID 1944 wrote to memory of 4160	1944	65f1a46722b855d51dfcd7e941af7ec4740a62489a35077c92d9379073207f09.exe	hcbnaf.exe
PID 1944 wrote to memory of 4160	1944	65f1a46722b855d51dfcd7e941af7ec4740a62489a35077c92d9379073207f09.exe	hcbnaf.exe

C:\Users\Admin\AppData\Local\Temp\65f1a46722b855d51dfcd7e941af7ec4740a62489a35077c92d9379073207f09.exe
"C:\Users\Admin\AppData\Local\Temp\65f1a46722b855d51dfcd7e941af7ec4740a62489a35077c92d9379073207f09.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1944

C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe
"C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5248 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe

Filesize
37KB

MD5
47eff7d75957be40effb51d725a10679

SHA1
a46ac85a2a4af7a3b2f83d869d24b86344ace31d

SHA256
49dde1f7287af967713bd75dd14e1205b0e07be204c5027d0dfbc1c6ae3fa364

SHA512
007e3a9204992c8c242e83555cecc1bcdfd95dad1374e0095c4acc206ba0064b90ad1390da41d69a5a933a8ac0124ced8f5b3f1488655c77ca5e156f0b667ba3

Download Submit